CVE-2025-39682: Linux kernel TLS (kTLS) zero-length record handling flaw

Exploited in the wild Critical 9.8 EPSS 3.3% Linux kernel

The kernel TLS receive path (net/tls/tls_sw.c) mishandles a zero-length record taken from the rx_list, so a record of a different type can slip past the one-type-per-recvmsg() rule and be processed with the wrong zero-copy assumptions. It only matters when an application uses kernel TLS (the tls module attached to TCP sockets); Red Hat says it can then be triggered remotely. NVD scores it 9.8 while Red Hat rates it Moderate. Linux 6.0 and later are affected; CISA added it to KEV on 18 September 2026.

• CVE-2025-39682CVE identifier
• 9.8CVSS 3.1 base score (critical)
• 2026-09-18added to CISA's exploited list (US federal deadline 2026-09-21)
• 3.3%EPSS: chance of exploitation in the next 30 days (higher than 88% of CVEs)
• 2025-09-05published

What do these terms mean? CVE · CVSS score · exploited (KEV) · EPSS · backported fix · all terms

Affected and fixed versions

Affected:

• Linux 6.0 through 6.1.148
• Linux 6.2 through 6.6.102
• Linux 6.7 through 6.12.43
• Linux 6.13 through 6.16.3

Fixed in:

• Linux 6.1.149
• Linux 6.6.103
• Linux 6.12.44
• Linux 6.16.4
• Linux 6.17

Am I affected?

uname -r
dpkg -l 'linux-image*' | grep ^ii   # Debian/Ubuntu
rpm -q kernel   # RHEL/Fedora/Amazon/SUSE (SUSE: rpm -q kernel-default)
lsmod | grep -w tls   # kernel TLS module loaded?

Patch it

Use the commands for your system. Distribution packages often keep an older version number with the fix backported, so compare with the fixed package versions in the table below, not only with the upstream version.

sudo apt update
sudo apt upgrade
sudo reboot
# Debian 11 'linux' (5.10) is not affected; only the linux-6.1 backport needs updating there.

sudo apt update
sudo apt upgrade
sudo reboot
# Ubuntu 20.04 and the 22.04 GA 5.15 kernel are not affected.

sudo dnf upgrade kernel
sudo reboot
# RHEL 7 and 8 are not affected (Red Hat).

sudo dnf upgrade --refresh kernel
sudo reboot

sudo zypper refresh
sudo zypper patch --category security
sudo reboot

# Amazon Linux 2023
sudo dnf upgrade --releasever=latest 'kernel*'
sudo reboot
# Amazon Linux 2 kernels are not affected.

sudo pacman -Syu
sudo reboot

# as root
apk update
apk upgrade
reboot

not Linux

General update steps for every system are on the Linux and Unix & BSD pages; after updating, see which services to restart.

Fix status in Linux distributions

From the Debian security tracker, Ubuntu CVE tracker and Red Hat Security Data API, refreshed every few hours.

If you cannot patch yet

• Red Hat: prevent the tls kernel module from loading, e.g. echo 'install tls /bin/false' | sudo tee /etc/modprobe.d/disable-tls.conf && sudo rmmod tls. This breaks applications that use kernel TLS offload.

Sources

• CVE record CVE-2025-39682
• NVD CVE-2025-39682
• CISA KEV entry CVE-2025-39682
• Debian security tracker CVE-2025-39682
• Ubuntu CVE page CVE-2025-39682
• Red Hat CVE page CVE-2025-39682
• SUSE CVE page CVE-2025-39682
• Amazon Linux ALAS CVE page CVE-2025-39682
• Upstream fix (tls: fix handling of zero-length records on the rx_list)
• Red Hat: how to blacklist a kernel module
• https://git.kernel.org/stable/c/2902c3ebcca52ca845c03182000e8d71d3a5196f
• https://git.kernel.org/stable/c/c09dd3773b5950e9cfb6c9b9a5f6e36d06c62677
• https://git.kernel.org/stable/c/3439c15ae91a517cf3c650ea15a8987699416ad9
• https://git.kernel.org/stable/c/29c0ce3c8cdb6dc5d61139c937f34cb888a6f42e
• CISA Known Exploited Vulnerabilities catalog

Page generated automatically from official sources on 2026-11-03 18:05 UTC and reviewed by an editor. Always confirm with your vendor's advisory.