CVE-2025-39682 Exploited in the wild
Linux Kernel Improper Check for Unusual or Exceptional Conditions Vulnerability
- Risk score
- 83/100
- CVSS
- Not Scored
- Added to CISA's exploited list
- 18 Sep 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Linux Kernel contains an improper check for unusual or exceptional conditions vulnerability in the TLS receive path which allows a zero-length record retrieved from the rx_list to bypass the intended recvmsg() record-type handling, potentially causing subsequent TLS records to be processed using incorrect zero-copy an…
- Affected
- Linux Kernel
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- Exploited in the wild
Story map
At a glance
Linux Kernel: Red, act today. A vulnerability in the Linux kernel allows an attacker to decrypt in place over page-cache backed frags, potentially leading to a high impact on confidentiality, integrity, and availability.
The flaws
- CVE-2025-39682: Linux Kernel Improper Check for Unusual or Exceptional Conditions Vulnerability (exploited)
- CVE-2026-46300: Linux Kernel Missing Initialization of a Variable Vulnerability (CVSS 7.8 · EPSS 10% · exploited)
- CVE-2025-39964: Linux Kernel Race Condition Vulnerability (exploited)
- CVE-2026-53266: Linux Kernel Out-of-Bounds Write Vulnerability (exploited)
The fix
Fix: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 guidance and CISA’s “Forensics Triage Requirements”
Who is exposed: {'product': 'linux kernel', 'vendor': 'linux'}
Where it stands
- Exploited in the wild
- On CISA's exploited list since 18 Sep
- US federal deadline 21 Sep
- 1 outlet covering it
How it unfolded
- 18 Sep, CISA (official): Added to the Known Exploited Vulnerabilities list (4 of these flaws)
- 21 Sep, Deadline (official): US federal agencies must have patched
- 28 Oct, CISA advisories (US) (official): CISA Adds Two Known Exploited Vulnerabilities to Catalog
- 28 Oct, SecurityWeek (press): China-Linked Hackers Exploit PHP2Shell to Root Firewalls
Connects to
- Same weakness: CWE-754 (CWE-754). 18 other warnings in 30 days
- Same product: Earlier Linux Kernel warnings. 2 in the last 90 days
- Reported alongside: PHP Stale Internal Request-State Vulnerability. CVE-2026-109619 · in 1 of the same article
Why it is Red
- Not yet scored by NVD
- Exploited in the wild (CISA KEV)
- On your watchlist: linux kernel
CISA required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Original description
Linux Kernel contains an improper check for unusual or exceptional conditions vulnerability in the TLS receive path which allows a zero-length record retrieved from the rx_list to bypass the intended recvmsg() record-type handling, potentially causing subsequent TLS records to be processed using incorrect zero-copy and queuing assumptions. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.
Last activity 18 Sep 2026. Patch Forecast updates every hour.