Login Sign Up

CVE-2025-39682

7.1 HIGH

📋 TL;DR

A Linux kernel TLS vulnerability where zero-length records on the rx_list can cause improper handling during decryption, potentially leading to memory corruption or crashes. This affects systems using kernel TLS (kTLS) functionality, particularly those handling TLS 1.3 connections.

💻 Affected Systems

Products:
  • Linux kernel with kTLS support
Versions: Linux kernel versions with the vulnerable TLS code (specific commit ranges in the stable branches referenced)
Operating Systems: Linux distributions using affected kernel versions
Default Config Vulnerable: ⚠️ Yes
Notes: Requires kTLS to be enabled and used, particularly with TLS 1.3 connections where zero-length records might occur.

📦 What is this software?

Debian Linux by Debian

View all CVEs affecting Debian Linux →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic or memory corruption leading to system crash, denial of service, or potential privilege escalation if combined with other vulnerabilities.

🟠

Likely Case

System instability, crashes, or denial of service affecting TLS connections, particularly under specific network conditions with zero-length records.

🟢

If Mitigated

Minor performance impact or connection failures for affected TLS sessions, with system stability maintained.

🌐 Internet-Facing: MEDIUM - Requires TLS connections to vulnerable systems, but exploitation depends on specific network traffic patterns.
🏢 Internal Only: MEDIUM - Internal TLS connections could trigger the vulnerability, but requires specific conditions.

🎯 Exploit Status

Public PoC: ✅ No
Weaponized: UNKNOWN
Unauthenticated Exploit: ⚠️ Yes
Complexity: MEDIUM

Exploitation requires sending specially crafted TLS traffic with zero-length records to trigger the condition.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Linux kernel versions with fixes from the referenced stable commits

Vendor Advisory: https://git.kernel.org/stable/c/2902c3ebcca52ca845c03182000e8d71d3a5196f

Restart Required: Yes

Instructions:

1. Update Linux kernel to patched version from your distribution vendor. 2. Reboot system to load new kernel. 3. Verify kernel version matches patched release.

🔧 Temporary Workarounds

Disable kTLS

linux

Disable kernel TLS functionality to avoid the vulnerable code path

echo 0 > /proc/sys/net/tls/enabled

Use userspace TLS

linux

Configure applications to use userspace TLS libraries instead of kernel TLS

🧯 If You Can't Patch

  • Implement network filtering to block or monitor for abnormal TLS traffic patterns
  • Monitor system logs for kernel panics or TLS-related errors and have incident response procedures ready

🔍 How to Verify

Check if Vulnerable:

Check kernel version and if kTLS is enabled: cat /proc/sys/net/tls/enabled

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version is updated beyond vulnerable commits and test TLS functionality

📡 Detection & Monitoring

Log Indicators:

  • Kernel panic messages
  • TLS/network stack error messages in dmesg or system logs
  • Application crashes related to TLS connections

Network Indicators:

  • Unusual TLS traffic patterns with zero-length records
  • Increased TLS connection failures

SIEM Query:

source="kernel" AND ("panic" OR "Oops" OR "TLS" OR "kTLS")

📊 Metadata

CVE ID: CVE-2025-39682
CVSS v3 Score: 7.1 (HIGH)
CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
EPSS Score: 0.02% exploit probability (3.3th percentile)
Published: September 5, 2025
Last Updated: January 27, 2026

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON