1. Executive summary
CVE-2025-39682 is a critical (CVSS 9.8, CWE-754) improper check for unusual or exceptional conditions vulnerability in the Linux kernel's TLS receive path. A zero-length record retrieved from the rx_list can bypass the intended recvmsg() record-type handling, causing subsequent TLS records to be processed under incorrect zero-copy and queuing assumptions. CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2026-09-18, citing evidence of active exploitation, with a federal remediation due date of 2026-09-21. The affected product(s) may be end-of-life or end-of-service, and CISA advises discontinuing use where mitigations are unavailable. EMEA financial services running affected kernel TLS offload paths on Linux hosts should treat this as an immediate patching priority.
2. Regulatory framing
| Article | Trigger (the fact in this item) | Practical impact |
|---|---|---|
| DORA Art. 24: digital operational resilience testing — general requirements | The vulnerability sits in the kernel TLS receive path, a component whose failure mode (corrupted record handling under zero-copy assumptions) is not exercised by standard application-layer TLS testing; CISA KEV listing with active exploitation makes it a concrete, dated test target | Include kernel-TLS-enabled hosts in the resilience testing scope and verify the fix against the zero-length record condition rather than relying on generic TLS test suites |
| DORA Art. 18: classification of ICT-related incidents and cyber threats | CISA KEV listing on 2026-09-18 with evidence of active exploitation is a specific, externally corroborated cyber threat trigger for classification decisions | Classify any detected exploitation of this CVE on in-scope systems under the incident classification process, with the KEV entry as the classification evidence |
No NIS2 or UK NIS article is directly engaged by the specific facts of this item beyond what any actively exploited kernel vulnerability would trigger.
3. Technical analysis & attack chain
Vulnerability mechanism. The flaw is in the kernel TLS receive path (kTLS). The receive path maintains an rx_list of decrypted records. When a zero-length record is retrieved from the rx_list, it bypasses the record-type handling that recvmsg() is supposed to apply. Subsequent TLS records are then processed under zero-copy and queuing assumptions that no longer hold, because the record-type state has been desynchronised. The verified reference data classifies this as CWE-754, improper check for unusual or exceptional conditions: the exceptional case, a zero-length record, is not checked correctly.
Attack chain (confirmed steps). The confirmed chain is short, because the source material does not describe a specific exploitation campaign:
- An attacker with the ability to deliver TLS records to a host using kernel TLS termination or offload sends a zero-length TLS record.
- The record is retrieved from the rx_list and bypasses recvmsg() record-type handling.
- Subsequent TLS records are processed with incorrect zero-copy and queuing assumptions, corrupting the receive path's state.
- The NVD entry states the impacted product(s) could be end-of-life and/or end-of-service, meaning patched versions may not exist for some deployments.
What is not in the source material. The sources do not describe privilege escalation, code execution, data exfiltration, persistence, command-and-control, or any named exploiting actor. The Hacker News report confirms only that CISA added the CVE to KEV citing evidence of active exploitation; it does not name the exploiting actor or describe observed intrusions. No MITRE ATT&CK profile for an exploiting actor exists in the verified reference data, so any attribution question is unconfirmed. The exact impact of the desynchronised state (memory corruption, information disclosure, or denial of service) is not specified in the provided material, and we do not speculate on it. The EPSS score is 1%, which is low relative to the KEV status; the KEV listing is the authoritative exploitation signal here.
Related KEV context. CISA added two other Linux kernel flaws in the same action: CVE-2026-53266, an out-of-bounds write in the ebtables SNAT target (ARP sender hardware address rewrite into a nonlinear socket-buffer fragment backed by a splice-imported file page), and CVE-2026-53362, an unspecified privilege escalation via the IPv6 networking subsystem. Both share the 2026-09-21-class due dates in their entries (2026-09-21 and 2026-08-30 respectively). Clients patching this CVE should check these two in the same cycle.
4. Mitigation & containment
P1, within 24 hours. Inventory all Linux hosts and appliances that use kernel TLS (kTLS) in the receive path: hosts running TLS termination with kernel offload, and any appliance or load balancer built on a Linux kernel with kTLS enabled. Identify the kernel versions in use and check vendor advisories for a fix for CVE-2025-39682. Where the product is end-of-life or end-of-service and no fix exists, plan to discontinue use or isolate the host, per the CISA guidance in the source.
P2, within 72 hours. Apply the vendor fix where one exists, prioritising internet-exposed and multi-tenant hosts. CISA's stated due date for federal agencies is 2026-09-21; treat that as the external benchmark. Where patching is not yet possible, disable kernel TLS offload on affected hosts and terminate TLS in userspace (for example, in the application or a proxy) until the patched kernel is deployed. This removes the vulnerable receive path from use. Confirm the change does not break socket options or performance assumptions in the affected service before rollout.
P3, within 7 days. Verify the fix on a representative sample of hosts by exercising the TLS receive path with zero-length records, confirming record-type handling behaves correctly. Fold CVE-2026-53266 and CVE-2026-53362 into the same patch cycle if they are not already remediated. Update asset records to flag any remaining end-of-life Linux kernel deployments as an exception requiring a migration date, since the NVD entry states the impacted product(s) could be EoL/EoS and CISA advises transitioning to a supported version.
5. Indicators of compromise
No indicators of compromise available in the source material.
The sources describe no atomic indicators and no observable behaviours specific to exploitation of this CVE. The KEV listing confirms active exploitation but provides no technical detail on how it manifests. Detection effort should therefore go to configuration and patch-state checks (§4) rather than indicator hunting.
6. Detection
Insufficient indicators to author detection rules.
The source material contains no strings, command lines, file paths, registry keys, mutexes, or network signatures attributable to exploitation of this CVE. The vulnerability name, CVE identifier, and product name are reporting artefacts, not threat artefacts, and cannot support a detection rule.
CVE assessment
1 referenced CVE — 1 actively exploited (CISA KEV), 1 critical (CVSS ≥ 9.0)
| CVE | CVSS | Exploited | EPSS | Summary |
|---|---|---|---|---|
| CVE-2025-39682 | 9.8 Critical | ⚠ KEV 2026-09-18 | 1% | In the Linux kernel, the following vulnerability has been resolved: tls: fix handling of zero-length records on the rx_list E… |
7. Sources
- NVD, CVE-2025-39682 — Linux Kernel: Linux Kernel Improper Check for Unusual or Exceptional Conditions Vulnerability, https://nvd.nist.gov/vuln/detail/CVE-2025-39682, 2026-09-17
- The Hacker News, CISA Flags Three Linux Kernel Vulnerabilities Exploited in the Wild, https://thehackernews.com/2026/09/cisa-flags-three-linux-kernel.html, 2026-09-18 (publication date inferred from "on Friday" relative to the KEV addition; verify against the page)
- NVD, CVE-2026-53266 — Linux Kernel: Linux Kernel Out-of-Bounds Write Vulnerability, https://nvd.nist.gov/vuln/detail/CVE-2026-53266, accessed 2026-09-19
- NVD, CVE-2026-53362 — Linux Kernel: Linux Kernel Unspecified Vulnerability, https://nvd.nist.gov/vuln/detail/CVE-2026-53362, accessed 2026-09-19
8. Adverse Trace position
We assess CVE-2025-39682 as critical (CVSS 9.8, CWE-754) and confirmed as actively exploited, on the strength of the CISA KEV listing dated 2026-09-18 in the verified reference data; the 1% EPSS score does not change that assessment, and the KEV state is the authoritative signal. The technical detail available is thin and single-sourced in substance: the mechanism description comes from the NVD entry alone, no exploiting actor is named, no MITRE ATT&CK profile exists in the verified data, and the concrete impact of the desynchronised receive path is not specified, so clients should verify vendor advisory detail before enforcing configuration changes. The exposure profile for EMEA financial services is concentrated in Linux hosts doing kernel TLS termination or offload, including appliances that may be end-of-life, and the practical risk is that a patch gap on those hosts persists past the 2026-09-21 CISA due date. We will monitor for vendor advisories naming affected kernel versions and fixed builds, for any technical reporting on observed exploitation, and for movement on CVE-2026-53266 and CVE-2026-53362, and we will update this advisory when specific version ranges or indicators emerge.
Published via PulseTrace — Adverse Trace threat intelligence.