Linux Kernel Improper Check for Unusual or Exceptional Conditions Vulnerability
Linux kernel TLS receive path: zero-length record bypasses recvmsg() handling, corrupting downstream TLS processing. CVSS 9.8. In CISA KEV Sept. 18, 2026.
- Vendor
- Linux
- Product
- Kernel
- CVSS
- 9.8
- EPSS (exploit probability)
- 0.5%
- Status
- kev
- CISA patch-by (BOD 22-01)
- Published
The TLS receive path in the Linux kernel checks for unusual or exceptional conditions improperly. A zero-length record retrieved from the rx_list bypasses the intended recvmsg() record-type handling. That bypass causes all TLS records received after the zero-length one to be processed under incorrect zero-copy and queuing assumptions.
CISA added this to the Known Exploited Vulnerabilities catalog on September 18, 2026 with active exploitation confirmed. Federal agencies must apply mitigations by September 21, 2026 under BOD 26-04.
NVD notes that affected versions may include end-of-life kernel releases. If you’re on an unsupported kernel with no available patch, migration to a supported version is the remediation path. See the NVD record and your distribution vendor’s advisories for version specifics.
Full coverage: CISA Adds Three Exploited Linux Kernel Flaws to KEV.
