The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added three actively exploited Linux kernel vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, led by a critical bug in the kernel’s Transport Layer Security (TLS) receive path tracked as CVE-2025-39682.[5][9][11] Federal civilian agencies have been ordered to remediate the flaws by September 21, 2026, effectively compressing patch timelines for any internet-facing Linux services that rely on kernel TLS offload.[5][15]
CVE-2025-39682 is described as an improper check for unusual or exceptional conditions in the Linux kernel’s kTLS software receive path, specifically its handling of zero-length TLS records taken from the rx_list.[1][2][8][14] Research into the bug shows it can lead to a use-after-free scenario during recvmsg() processing, corrupting kernel memory structures and potentially allowing local attackers to crash the system or escalate privileges to root on affected hosts.[10][12] The issue impacts multiple Linux kernel branches, including releases from 6.0 through 6.16.3 and early 6.17 release candidates where kTLS is enabled, and has been rated critical with a CVSS score of 9.8 in several vulnerability databases.[6][9][12] Upstream maintainers have already merged fixes, and vendors such as Debian and Siemens have issued coordinated advisories and backports for supported distributions and appliances.[1][3][12]
While CVE-2025-39682 has grabbed most of the attention, CISA’s KEV update also highlights CVE-2026-53266 and CVE-2025-39964 as part of the same actively exploited set of Linux kernel flaws.[9][11] CVE-2026-53266 carries a CVSS score of 8.8 and involves an out-of-bounds write in the ebtables SNAT Address Resolution Protocol (ARP) rewrite logic, a component frequently used in firewalling and network address translation on Linux bridges.[9] CVE-2025-39964, rated 7.8, is tied to a race condition when multiple operations concurrently write to the same AF_ALG socket, raising the risk of data corruption, information disclosure or denial-of-service in systems that rely on the kernel’s cryptographic interface.[9] Both issues extend the impact beyond TLS into core packet-filtering and crypto subsystems, amplifying the exposure for diverse Linux deployments.[9]
CISA’s decision to move all three vulnerabilities into the KEV catalog signals that exploitation is not merely theoretical; public reporting indicates that threat actors are already leveraging these flaws in real-world attacks, even though detailed exploit chains have not been fully disclosed.[5][9][11] For CVE-2025-39682 in particular, analysts note that the bug can be triggered remotely when kernel TLS is in use, making high-throughput web or application servers that offload TLS processing to the kernel an attractive target.[3][5][10] Some trackers also warn that certain affected kernel versions may be end-of-life or end-of-service, leaving organizations that have not upgraded to supported releases without vendor patches and increasing the likelihood of opportunistic exploitation against legacy infrastructure.[14]
Defenders are being urged to prioritize discovery and remediation over routine patch cycles, starting with a clear inventory of systems that enable kTLS and use Linux kernels in the affected version ranges.[1][10][12][13] Security teams should apply vendor-provided fixes or upgrade to patched kernel builds as soon as feasible, paying particular attention to Debian and Siemens advisories that map CVE-2025-39682 to specific product releases.[1][3][12] Where immediate patching is not possible, experts recommend disabling kernel TLS offload, tightening exposure of ebtables-based bridge filtering, and restricting or monitoring use of AF_ALG sockets until mitigations can be fully deployed.[3][10][13] Given CISA’s aggressive remediation deadline and the confirmed exploitation of these flaws, organizations that treat Linux servers as “set-and-forget” infrastructure will need to revisit their assumptions and move quickly to close the window for attackers.[5][9][11]
References
- CVE-2025-39682
- CVE-2025-39682 Detail – NVD – NIST
- CVE-2025-39682: Linux Kernel TLS Handling DoS Flaw
- CVE-2025-39682 in KEV: Patch Linux kTLS Before Sept. 21
- CVE-2025-39682 – Vulnerability Details – OpenCVE
- cvelistv5 – cve-2025-39682 – Vulnerability-Lookup
- CISA nimmt drei aktiv ausgenutzte Linux-Kernel-Schwachstellen ins KEV-Register
- Linux kernel kTLS zero-length rx_list use-after-free – Mallory.ai
- CISA Flags Three Actively Exploited Linux Kernel Flaws, Orders Federal Patch by Sunday
- (CVE-2025-39682) Linux Kernel net/tls Use-After-Free … – STAR Labs
- CVE-2025-39682 Impact, Exploitability, and Mitigation Steps | Wiz
- CVE-2025-39682 – tls: fix handling of zero-length records …
- cve 2025 39682
