CVE-2025-39682
In the Linux kernel, the following vulnerability has been resolved: tls: fix handling of zero-length records on the rx_list Each recvmsg() call must process either - only contiguous DATA records (any number of them) - one non-DATA record If the next record has different type than what has already been processed we break out of the main processing loop. If the record has already been decrypted (which may be the case for TLS 1.3 where we don't know type until decryption) we queue the pending record to the rx_list. Next recvmsg() will pick it up from there. Queuing the skb to rx_list after zero-copy decrypt is not possible, since in that case we decrypted directly to the user space buffer, and we don't have an skb to queue (darg.skb points to the ciphertext skb for access to metadata like length). Only data records are allowed zero-copy, and we break the processing loop after each non-data record. So we should never zero-copy and then find out that the record type has changed. The corner case we missed is when the initial record comes from rx_list, and it's zero length.
Actively exploited
- In the CISA exploited-vulnerabilities catalogue since Sep 18, 2026
- US federal agencies must remediate it by Sep 21, 2026 (BOD 22-01)
- First attack observed 377 days after disclosure
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Source: CISA KEV · Sep 18, 2026
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HAffected products
| Vendors | Product | Versions |
|---|---|---|
| linux | linux kernel | < 6.1.149 |
| debian | debian linux | 11.0 |
| siemens | simatic cn 4100 firmware | < 5.0 |
| siemens | simatic cn 4100 | - |
Related articles
P7 DarkSword iOS Variant Steals Crypto Wallets and Accepts Remote Commands, iVerify Says
iVerify reports P7 DarkSword iOS variant steals keychain and wallet data and accepts remote commands; Censys describes linked servers and operator claims.
Armatura One Security Failures Put Access-Control Hosts, Databases, and Credentials at Risk
CISA reports five Armatura One flaws, including unauthenticated ActiveMQ RCE and hardcoded credentials exposing databases, hosts and access control.
Active Roundcube Attacks Put Pre-Login SQL Injection at the Top of Patch Queues
Attackers exploit CVE-2026-48842, a pre-auth Roundcube SQL injection. Learn affected versions 1.6.x, 1.7.x and how to patch now.
CISA Adds Two Exploited Flaws to KEV and Gives Federal Agencies Three Days to Patch
CISA added CVE-2026-5430 (WSO2) and CVE-2026-71362 (Adobe Commerce) to KEV with Sept 27 patch deadline amid active exploitation.
Active Attacks Turn Check Point VPN and Management Flaws Into an Immediate Patch Priority
Check Point confirms active exploits of two critical 9.8 flaws in VPN gateways and management servers. CISA sets Sept 25 patch deadline.
Active Attacks Put Zyxel Switches and Veeam-Protected Windows Endpoints at Risk
CISA warns of active exploitation of Zyxel GS1900 flaw CVE-2026-7273 and Veeam Agent Windows privilege escalation CVE-2026-32996. Patch now.
Exploited Cisco ISE Flaw Leads a Wave of Attacks on Trusted Software Channels
Active exploitation of a critical Cisco ISE flaw highlights attacks through trusted software channels, Orkes, Discourse, libheif and AI plugins.
Three Exploited Linux Kernel Flaws Trigger Immediate CISA Patch Deadline
CISA flags three exploited Linux kernel flaws in TLS, AF_ALG and ebtables, setting a September 21, 2026 patch deadline for federal agencies.
This product uses the NVD API but is not endorsed or certified by the NVD.