CISA Adds Linux Kernel Flaw CVE-2025-39682 to KEV Catalog

CISA has added the Linux Kernel vulnerability CVE-2025-39682 to its Known Exploited Vulnerabilities catalog.

CISA catalogs the Linux Kernel vulnerability. The entry was added on 2026-09-18 with a federal remediation deadline of 2026-09-21.

The issue reportedly stems from an improper check for unusual or exceptional conditions in the TLS receive path. A zero-length record retrieved from the rx_list can bypass the intended recvmsg() record-type handling.

The flaw allows zero-length records to bypass intended handling. This reportedly enables subsequent TLS records to be processed using incorrect zero-copy and queuing assumptions.

The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.

Required actions focus on mitigations and risk-based patching. Agencies must apply mitigations in accordance with vendor instructions while complying with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk guidance and the “Forensics Triage Requirements.” For cloud services, stakeholders must follow applicable BOD 26-04 guidance or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

The vulnerability links to multiple kernel commits and related standards. It is tied to CWE-754. Forensic triage is required per BOD-26-04. It remains unknown whether the vulnerability is known to be used in ransomware campaigns. The flaw affects an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products.