Zero Length Tls Record Mishandling In The Linux Kernel Tls Receive Cve 2025 39682

exploitbulletin.com • September 20, 2026

Zero-length TLS record mishandling in the Linux kernel TLS receive path corrupts record processing (CVE-2025-39682)

CISA added this kernel flaw to KEV on 2026-09-18 with a 2026-09-21 remediation deadline and a public exploit is catalogued in VulnCheck XDB, so kTLS-enabled hosts left on unpatched kernels are exposed to an attacker who can simply connect to them.

The kernel TLS (kTLS) receive path fails to check for a zero-length record pulled from rx_list, letting a remote peer bypass recvmsg() record-type handling so that subsequent records are processed under wrong zero-copy and queuing assumptions. The flaw is reachable over the network without authentication and is rated as fully compromising confidentiality, integrity and availability of the host.

Affected: Linux kernel from commit 84c61fe1a75b (kTLS zero-copy receive, 6.0) up to the stable fix commits 2902c3eb, c09dd377, 3439c15a, 29c0ce3c, 62708b94; Linux 6.0

Confirm the running kernel version and verify it contains one of the stable fix commits listed in the advisory (2902c3ebcca5, c09dd3773b59, 3439c15ae91a, 29c0ce3c8cdb, 62708b9452f8) or the Debian LTS update from the October 2025 debian-lts-announce; identify hosts where kernel TLS offload (the kernel tls socket option) is enabled in the TLS-terminating service, since only those expose the vulnerable receive path. On such hosts review kernel logs for TLS-related oopses or warnings and unexpected TLS sessions from unknown peers around the time of exposure.

Upgrade to a kernel containing the stable fix commits (2902c3ebcca5, c09dd3773b59, 3439c15ae91a, 29c0ce3c8cdb, 62708b9452f8) or your distribution's equivalent (Debian LTS: see the October 2025 debian-lts-announce update; Siemens customers: SSA-032379) and reboot. If an upgrade must wait, disable kernel TLS offload in the TLS-terminating application so the vulnerable receive path is not used.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Linux Kernel Vulnerability CVE-2025-39682 Under Active Exploitation A critical vulnerability (CVE-2025-39682) in the Linux kernel allows remote code execution through mishandling of zero-length TLS records. This flaw affects kTLS-enabled hosts running vulnerable kernel versions, exposing them to attackers without authentication. CISA added this vulnerability to its Known Exploited Vulnerabilities (KEV) list on September 18, 2026, with a remediation deadline of September 21, 2026. The vulnerability can fully compromise the confidentiality, integrity, and availability of affected systems. Public exploits are available, and administrators are urged to patch immediately. The flaw impacts Linux kernel versions from commit 84c61fe1a75b to the stable fix commits. Gravity Forms also has a separate critical vulnerability (CVE-2026-84434) that allows unauthenticated file uploads leading to remote code execution. Organizations using affected software must prioritize updates to mitigate these risks. 3 sources 80

Extracted Entities

Zero Length Tls Record Mishandling In The Linux Kernel Tls Receive Cve 2025 39682

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)

Platforms (1)

Vulnerabilities (1)