Linux Kernel Improper Check for Unusual or Exceptional Conditions Vulnerability
Linux kernel TLS receive path: zero-length record bypasses recvmsg() handling, corrupting downstream TLS processing. CVSS 9.8. In CISA KEV Sept. 18, 2026.
- Vendor
- Linux
- Product
- Kernel
- CVSS
- 9.8
- EPSS (exploit probability)
- 3.3%
- Status
- kev
- CISA patch-by (BOD 22-01)
- Published
Is CVE-2025-39682 being exploited?
Yes. CISA added CVE-2025-39682 to its Known Exploited Vulnerabilities catalog on . CISA only lists a CVE when it has reliable evidence of exploitation in the wild.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 3.3% (scored October 25, 2026).
- CISA KEV[ LISTED ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-11-05. Full cross-catalog view: /kev-comparison
CVE-2025-39682 timeline
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
What to do
US federal civilian agencies must remediate by (3 days after listing) under BOD 22-01. Everyone else: that deadline is a sensible upper bound, not a target. Vendor guidance and the NVD record are linked under Source above.
The TLS receive path in the Linux kernel checks for unusual or exceptional conditions improperly. A zero-length record retrieved from the rx_list bypasses the intended recvmsg() record-type handling. That bypass causes all TLS records received after the zero-length one to be processed under incorrect zero-copy and queuing assumptions.
CISA added this to the Known Exploited Vulnerabilities catalog on September 18, 2026 with active exploitation confirmed. Federal agencies must apply mitigations by September 21, 2026 under BOD 26-04.
NVD notes that affected versions may include end-of-life kernel releases. If you’re on an unsupported kernel with no available patch, migration to a supported version is the remediation path. See the NVD record and your distribution vendor’s advisories for version specifics.
Full coverage: CISA Adds Three Exploited Linux Kernel Flaws to KEV.
Other Linux Kernel CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2026-46300 Linux Kernel Missing Initialization of a Variable Vulnerabilitywrite-up | [ HIGH ] | 7.8 | 16.1% | |
| CVE-2026-98432 Linux Kernel IPv4 TCP Use-After-Freewrite-up | [ CRITICAL ] | 9.8 | 0.8% | — |
| CVE-2026-53266 Linux Kernel Out-of-Bounds Write Vulnerabilitywrite-up | [ HIGH ] | 8.8 | 0.9% | |
| CVE-2025-39964 Linux Kernel Race Condition Vulnerabilitywrite-up | [ HIGH ] | 7.8 | 1.6% | |
| CVE-2026-53362 Linux Kernel Unspecified Vulnerability | [ HIGH ] | 7.8 | 0.7% | |
| CVE-2022-0995 Linux Kernel Out-of-Bounds Write Vulnerability | [ HIGH ] | 7.8 | 8.9% | |
| CVE-2026-53264 Linux kernel traffic-control subsystem use-after-free racewrite-up | [ HIGH ] | 7.8 | 0.5% | — |
| CVE-2022-0492 Linux Kernel Improper Authentication Vulnerability | [ HIGH ] | 7.8 | 5.5% |
