LiveActive security incident?Get immediate response
CVE Record

CVE-2025-39682: tls: fix handling of zero-length records on the rx_list

In the Linux kernel, the following vulnerability has been resolved: tls: fix handling of zero-length records on the rx_list Each recvmsg() call must process either - only contiguous DATA records (any number of them) - one non-DATA record If the next record has different type than what has already been processed we break out of the main processing loop. If the record has already been decrypted (which may be the case for TLS 1.3 where we don't know type until decryption) we queue the pending record to the rx_list. Next recvmsg() will pick it up from there. Queuing the skb to rx_list after zero-copy decrypt is not possible, since in that case we decrypted directly to the user space buffer, and we don't have an skb to queue (darg.skb points to the ciphertext skb for access to metadata like length). Only data records are allowed zero-copy, and we break the processing loop after each non-data record. So we should never zero-copy and then find out that the record type has changed. The corner case we missed is when the initial record comes from rx_list, and it's zero length.

CriticalCVSS 9.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysiscritical

Security readout for executives and security teams

Plain-English summary

A flaw in Linux kernel TLS receive handling can mishandle a zero-length record queued for later processing. The supplied record rates it critical, but does not establish the resulting failure mode or prove remote code execution. Exposure depends on use of kernel TLS and whether untrusted traffic can reach the affected receive path.

Executive priority

Treat this as an urgent validation and patching task because the assigned severity is critical and the modeled attack is remote. Do not assume every Linux system is vulnerable: focus first on externally reachable systems using kTLS. Request evidence of the running fixed package, not merely confirmation that an update was installed.

Technical view

The kTLS recvmsg() path separates contiguous DATA records from non-DATA records. When an initial zero-length record comes from rx_list after zero-copy processing, the code can attempt handling that assumes an skb is available, although zero-copy decrypted directly into userspace. Referenced Linux stable commits correct this corner case. The supplied CVSS is 9.8, but detailed impact evidence is incomplete.

Likely exposure

Prioritize Linux hosts using kernel TLS receive processing, especially network-facing services accepting untrusted TLS traffic. The supplied affected data identifies multiple Linux release lines but is insufficient for reliable package-level matching. Distribution and appliance kernels may carry backports, so kernel version strings alone cannot conclusively establish exposure.

Exploitation context

The source bundle does not identify CVE-2025-39682 as CISA KEV and provides no evidence of active exploitation or a public exploit. Its network CVSS vector indicates modeled remote reachability without privileges or user interaction, but the supplied technical description does not demonstrate a practical compromise outcome.

Researcher notes

The available description establishes a zero-length rx_list corner case involving record-type boundaries, zero-copy decryption, and unavailable skb queuing. It does not state whether the observable result is a crash, memory corruption, disclosure, or another condition. Researchers should avoid inferring code execution from CVSS alone and should use vendor backport data for version assessment.

Mitigation direction

  • Apply the distribution or product vendor update containing the appropriate referenced Linux stable fix.
  • Consult vendor advisories to map fixed commits to deployed kernel packages and appliance firmware.
  • Prioritize internet-facing systems confirmed to use kernel TLS receive processing.
  • Use vendor-supported compensating controls if updating cannot be completed promptly.

Validation and detection

  • Inventory running kernel versions, distribution package revisions, and vendor firmware builds.
  • Determine whether affected services enable kernel TLS rather than userspace-only TLS.
  • Compare vendor package changelogs against the referenced Linux stable fix commits.
  • Reboot updated systems when required, then verify the corrected kernel is running.
  • Monitor vendor advisories for revised impact, affected-version, or exploitation information.
Prepared
Confidence
medium
Sources
9

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-39682 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Critical
CVSS
9.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
3ADP providers
8Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
9.8CVSS 3.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9Linux

Vulnerability scoring details

Base CVSS 3.1 score

9.8Critical
CVSS 3.1 vector shape for CVE-2025-39682Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container
siemens-SADPADP container
CISA-ADPCISA ADP Vulnrichment
other:ssvc

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux84c61fe1a75b4255df1e1e7c054c9e6d048da417, 84c61fe1a75b4255df1e1e7c054c9e6d048da417, 84c61fe1a75b4255df1e1e7c054c9e6d048da417, 84c61fe1a75b4255df1e1e7c054c9e6d048da417, 84c61fe1a75b4255df1e1e7c054c9e6d048da417unaffected
LinuxLinux6.0, 0, 6.1.149, 6.6.103, 6.12.44, 6.16.4, 6.17affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.