Vulnpedia
← All CVEs

CVE-2025-39682

CRITICAL 9.8 KNOWN EXPLOITED PoC CATALOGUED ALL-YEARS

Published 2025-09-05 · Last modified 2026-10-07 · Linux · NVD: Analyzed

In the Linux kernel, the following vulnerability has been resolved: tls: fix handling of zero-length records on the rx_list Each recvmsg() call must process either - only contiguous DATA records (any number of them) - one non-DATA record If the next record has different type than what has already been processed we break out of the main processing loop. If the record has already been decrypted (which may be the case for TLS 1.3 where we don't know type until decryption) we queue the pending record to the rx_list. Next recvmsg() will pick it up from there. Queuing the skb to rx_list after zero-copy decrypt is not possible, since in that case we decrypted directly to the user space buffer, and we don't have an skb to queue (darg.skb points to the ciphertext skb for access to metadata like length). Only data records are allowed zero-copy, and we break the processing loop after each non-data record. So we should never zero-copy and then find out that the record type has changed. The corner case we missed is when the initial record comes from rx_list, and it's zero length.

ACTIVELY EXPLOITED

Confirmed exploited in the wild — in CISA KEV since 2026-09-18. Patch or mitigate now.

Exploitation likelihood

3.3%chance of exploitation in 30 days · 88th percentile

● In CISA KEV (2026-09-18)● Catalogued PoC◆ SSVC: exploitation active, automatable yes

Impact if exploited

9.8CVSS 3.1 · CRITICAL · CNA

  • ConfidentialityHigh
  • IntegrityHigh
  • AvailabilityHigh

What an attacker needs

  • ✓Access: Reachable over the network — no local access needed
  • ✓Privileges: No account or privileges required
  • ✓User interaction: No user interaction needed
  • ✓Complexity: No special conditions — reliably repeatable

✓ lowers the bar for an attacker · ⚠ raises it

Proof of concept

Public PoC or exploit resources are catalogued below.

Listed by the named source; Vulnpedia has not tested these resources.

PoC data: JSON

Resource commands

curl -s https://vulnpedia.com/cve/CVE-2025-39682/poc.jsonMachine-readable PoC index for this CVE (for automation).

Search for new PoCs

Search GitHub now — results may be empty or unverified.

Tracked sources are checked weekly for the full archive, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.

Data snapshot:

Affected

Vendors Linux Siemens Debian

Products Linux Simatic Cn 4100 Linux Kernel Debian Linux Simatic Cn 4100 Firmware

Weakness (CWE)

  • CWE-754: Improper Check for Unusual or Exceptional Conditions

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References and research data (JSON)

Vendor product assessments

Showing 32 of 1182 vendor product statements; 1150 omitted. Read the full vendor advisory.

  • kernel-64k-debug-debuginfo-0:6.12.0-55.37.1.el10_0.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_0?arch=aarch64

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Vendor guidance
    • workaround: To mitigate this issue, prevent module tls from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.
    Red Hat · CVE-2025-39682 · Updated 2026-09-21T12:58:19+00:00
  • rv-0:6.12.0-55.37.1.el10_0.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_0?arch=ppc64le

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Vendor guidance
    • workaround: To mitigate this issue, prevent module tls from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.
    Red Hat · CVE-2025-39682 · Updated 2026-09-21T12:58:19+00:00
  • kernel-64k-debuginfo-0:5.14.0-427.96.1.el9_4.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_4?arch=aarch64

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Vendor guidance
    • workaround: To mitigate this issue, prevent module tls from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.
    Red Hat · CVE-2025-39682 · Updated 2026-09-21T12:58:19+00:00
  • kernel-debug-debuginfo-0:5.14.0-570.49.1.el9_6.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_6?arch=aarch64

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Vendor guidance
    • workaround: To mitigate this issue, prevent module tls from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.
    Red Hat · CVE-2025-39682 · Updated 2026-09-21T12:58:19+00:00
  • kernel-0:6.12.0-55.37.1.el10_0.src as a component of Red Hat Enterprise Linux BaseOS (v. 10) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_0?arch=src

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Vendor guidance
    • workaround: To mitigate this issue, prevent module tls from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.
    Red Hat · CVE-2025-39682 · Updated 2026-09-21T12:58:19+00:00
  • kernel-tools-0:6.12.0-55.37.1.el10_0.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 10) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_0?arch=x86_64

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Vendor guidance
    • workaround: To mitigate this issue, prevent module tls from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.
    Red Hat · CVE-2025-39682 · Updated 2026-09-21T12:58:19+00:00
  • kernel-debug-modules-0:5.14.0-284.144.1.el9_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS E4S (v.9.2) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_2?arch=aarch64

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Vendor guidance
    • workaround: To mitigate this issue, prevent module tls from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.
    Red Hat · CVE-2025-39682 · Updated 2026-09-21T12:58:19+00:00
  • kernel-0:5.14.0-427.96.1.el9_4.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.4) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_4?arch=s390x

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Vendor guidance
    • workaround: To mitigate this issue, prevent module tls from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.
    Red Hat · CVE-2025-39682 · Updated 2026-09-21T12:58:19+00:00
  • kernel-tools-debuginfo-0:5.14.0-427.96.1.el9_4.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.4) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_4?arch=aarch64

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Vendor guidance
    • workaround: To mitigate this issue, prevent module tls from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.
    Red Hat · CVE-2025-39682 · Updated 2026-09-21T12:58:19+00:00
  • kernel-debug-modules-extra-0:5.14.0-570.49.1.el9_6.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 9) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_6?arch=ppc64le

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Vendor guidance
    • workaround: To mitigate this issue, prevent module tls from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.
    Red Hat · CVE-2025-39682 · Updated 2026-09-21T12:58:19+00:00
  • kernel-debuginfo-common-ppc64le-0:6.12.0-55.37.1.el10_0.ppc64le as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_0?arch=ppc64le

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Vendor guidance
    • workaround: To mitigate this issue, prevent module tls from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.
    Red Hat · CVE-2025-39682 · Updated 2026-09-21T12:58:19+00:00
  • perf-debuginfo-0:5.14.0-427.96.1.el9_4.s390x as a component of Red Hat CodeReady Linux Builder EUS (v.9.4) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_4?arch=s390x

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Vendor guidance
    • workaround: To mitigate this issue, prevent module tls from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.
    Red Hat · CVE-2025-39682 · Updated 2026-09-21T12:58:19+00:00
  • kernel-rt-0:5.14.0-284.144.1.rt14.429.el9_2.src as a component of Red Hat Enterprise Linux Real Time for NFV E4S (v.9.2) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_2?arch=src

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Vendor guidance
    • workaround: To mitigate this issue, prevent module tls from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.
    Red Hat · CVE-2025-39682 · Updated 2026-09-21T12:58:19+00:00
  • kernel-rt-0:6.12.0-55.37.1.el10_0.aarch64 as a component of Red Hat Enterprise Linux Real Time (v. 10) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_0?arch=aarch64

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Vendor guidance
    • workaround: To mitigate this issue, prevent module tls from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.
    Red Hat · CVE-2025-39682 · Updated 2026-09-21T12:58:19+00:00
  • kernel-rt-debug-0:5.14.0-427.96.1.el9_4.x86_64 as a component of Red Hat Enterprise Linux Real Time EUS (v.9.4) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_4?arch=x86_64

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Vendor guidance
    • workaround: To mitigate this issue, prevent module tls from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.
    Red Hat · CVE-2025-39682 · Updated 2026-09-21T12:58:19+00:00
  • python3-perf-debuginfo-0:5.14.0-570.49.1.el9_6.x86_64 as a component of Red Hat Enterprise Linux Real Time (v. 9) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_6?arch=x86_64

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Vendor guidance
    • workaround: To mitigate this issue, prevent module tls from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.
    Red Hat · CVE-2025-39682 · Updated 2026-09-21T12:58:19+00:00
  • kernel as a component of Red Hat Enterprise Linux 6 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/kernel

    Red Hat · CVE-2025-39682 · Updated 2026-09-21T12:58:19+00:00
  • kernel-doc as a component of Red Hat Enterprise Linux 6 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/kernel-doc

    Red Hat · CVE-2025-39682 · Updated 2026-09-21T12:58:19+00:00
  • perf as a component of Red Hat Enterprise Linux 6 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/perf

    Red Hat · CVE-2025-39682 · Updated 2026-09-21T12:58:19+00:00
  • kernel-debug as a component of Red Hat Enterprise Linux 7 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/kernel-debug

    Red Hat · CVE-2025-39682 · Updated 2026-09-21T12:58:19+00:00
  • kernel-kdump-devel as a component of Red Hat Enterprise Linux 7 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/kernel-kdump-devel

    Red Hat · CVE-2025-39682 · Updated 2026-09-21T12:58:19+00:00
  • kernel-rt-doc as a component of Red Hat Enterprise Linux 7 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/kernel-rt-doc

    Red Hat · CVE-2025-39682 · Updated 2026-09-21T12:58:19+00:00
  • kernel-tools as a component of Red Hat Enterprise Linux 7 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/kernel-tools

    Red Hat · CVE-2025-39682 · Updated 2026-09-21T12:58:19+00:00
  • bpftool as a component of Red Hat Enterprise Linux 8 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/bpftool

    Red Hat · CVE-2025-39682 · Updated 2026-09-21T12:58:19+00:00
  • kernel-cross-headers as a component of Red Hat Enterprise Linux 8 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/kernel-cross-headers

    Red Hat · CVE-2025-39682 · Updated 2026-09-21T12:58:19+00:00
  • kernel-debug-modules-internal as a component of Red Hat Enterprise Linux 8 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/kernel-debug-modules-internal

    Red Hat · CVE-2025-39682 · Updated 2026-09-21T12:58:19+00:00
  • kernel-modules-extra as a component of Red Hat Enterprise Linux 8 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/kernel-modules-extra

    Red Hat · CVE-2025-39682 · Updated 2026-09-21T12:58:19+00:00
  • kernel-rt-debug-devel as a component of Red Hat Enterprise Linux 8 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/kernel-rt-debug-devel

    Red Hat · CVE-2025-39682 · Updated 2026-09-21T12:58:19+00:00
  • kernel-rt-kvm as a component of Red Hat Enterprise Linux 8 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/kernel-rt-kvm

    Red Hat · CVE-2025-39682 · Updated 2026-09-21T12:58:19+00:00
  • kernel-selftests-internal as a component of Red Hat Enterprise Linux 8 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/kernel-selftests-internal

    Red Hat · CVE-2025-39682 · Updated 2026-09-21T12:58:19+00:00
  • kernel-zfcpdump-devel as a component of Red Hat Enterprise Linux 8 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/kernel-zfcpdump-devel

    Red Hat · CVE-2025-39682 · Updated 2026-09-21T12:58:19+00:00
  • python3-perf as a component of Red Hat Enterprise Linux 8 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/python3-perf

    Red Hat · CVE-2025-39682 · Updated 2026-09-21T12:58:19+00:00

Unverified PoC candidates

Catalogue matches for further research. These repositories have not been validated as working exploits.

2 candidates

Additional exploitation reports

Source-specific reports, separate from CISA KEV. Repeated observations from one source are not independent confirmations.

  • VulnCheck KEV · 2026-09-18T00:00:00Z

    Source guidance: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

    Source ransomware assessment: Unknown

    VulnCheck KEV · CVE-2025-39682 · Updated 2026-09-18T00:00:00Z
  • VulnCheck KEV · 2026-09-18T00:00:00ZVulnCheck KEV · CVE-2025-39682

Known Affected Software Configurations

VendorProductVersion range
LinuxLinux Kernel≥ 6.0 and < 6.1.149
LinuxLinux Kernel≥ 6.2 and < 6.6.103
LinuxLinux Kernel≥ 6.7 and < 6.12.44
LinuxLinux Kernel≥ 6.13 and < 6.16.4
LinuxLinux Kernel6.17
LinuxLinux Kernel6.17
DebianDebian Linux11.0
SiemensSimatic Cn 4100 Firmware< 5.0

All CVSS metrics

  • CRITICAL 9.8 v3.1 · CNA Primary
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  • CRITICAL 9.8 v3.1 · NVD Secondary
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Patches & mitigations

Advisories

Technical & other

Sources: NVD · CVE.org · All sources and attribution · EPSS