CVE-2025-39682: Linux Kernel exploitation alert

CVE-2025-39682: what changed

CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 2026-09-18. Inclusion indicates evidence of exploitation; it does not establish that your own systems have been compromised.

Affected product

Linux Kernel. Confirm affected versions against the vendor advisory.

CISA description

Linux Kernel contains an improper check for unusual or exceptional conditions vulnerability in the TLS receive path which allows a zero-length record retrieved from the rxlist to bypass the intended recvmsg record-type handling, potentially causing subsequent TLS records to be processed using incorrect zero-copy and queuing assumptions. The impacted products could be end-of-life EoL and/or end-of-service EoS. Users are advised to discontinue use and/or transition to a supported version.

Recommended response

Inventory affected deployments, check vendor guidance for fixes or mitigations, and verify the update was applied. Review available logs and incident-response guidance when exploitation is suspected.

Catalog context

CISA lists a remediation due date of 2026-09-21. Federal directive deadlines have a defined scope; other organizations should prioritize according to their exposure and risk. Ransomware campaign use is listed as unknown; “unknown” does not mean exploitation is absent.

Sources

• CISA Known Exploited Vulnerabilities catalog
• CVE-2025-39682 reference

Automated security brief based on CISA catalog data. Catalog addition date: 2026-09-18.