CVE-2025-39682 A-440544511 ASB-A-440544511
tls: fix handling of zero-length records on the rx_list
Critical
Known exploited
Linux
- Severity
- 9.8 / 10
- Critical · CVSS 3.1
- Exploit chance (EPSS)
- 3.25%
- Chance of exploitation in the next 30 days. Higher than 88.34% of scored vulnerabilities.
- Known exploited
- Yes
- In CISA's catalog since Sep 18, 2026
- Weakness
- CWE-754 Improper Check for Unusual or Exceptional Conditions
- Fix
6.16.4- Upgrade Kernel to this version or later
Exploited in the wild. Linux Kernel Improper Check for Unusual or Exceptional Conditions Vulnerability (Linux Kernel). Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Due for U.S. federal agencies by Sep 21, 2026.
Description
In the Linux kernel, the following vulnerability has been resolved:
tls: fix handling of zero-length records on the rx_list
Each recvmsg() call must process either
- only contiguous DATA records (any number of them)
- one non-DATA record
If the next record has different type than what has already been processed we break out of the main processing loop. If the record has already been decrypted (which may be the case for TLS 1.3 where we don't know type until decryption) we queue the pending record to the rx_list. Next recvmsg() will pick it up from there.
Queuing the skb to rx_list after zero-copy decrypt is not possible, since in that case we decrypted directly to the user space buffer, and we don't have an skb to queue (darg.skb points to the ciphertext skb for access to metadata like length).
Only data records are allowed zero-copy, and we break the processing loop after each non-data record. So we should never zero-copy and then find out that the record type has changed. The corner case we missed is when the initial record comes from rx_list, and it's zero length.
Affected versions
Linux
| Package | Vulnerable | Fixed in |
|---|---|---|
| Kernel | >= 6.0.0, < 6.1.149>= 6.2.0, < 6.6.103>= 6.7.0, < 6.12.44>= 6.13.0, < 6.16.4 |
6.1.1496.6.1036.12.446.16.4 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
Kernel Linux → 6.16.4
Set Kernel to 6.16.4 or later in your manifest.
Severity breakdown
CVSS 3.1 9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Weakness
CWE-754: Improper Check for Unusual or Exceptional Conditions
The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.
How to prevent it
- Requirements: Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. Choose languages with features such as exception handling that force the programmer to anticipate unusual conditions that may generate exceptions. Custom exceptions may need to be developed to handle unusual business-logic conditions. Be careful not to pass sensitive exceptions back to the user (CWE-209, CWE-248).
- Implementation: Check the results of all functions that return a value and verify that the value is expected.
- Implementation: If using exception handling, catch and throw specific exceptions instead of overly-general exceptions (CWE-396, CWE-397). Catch and handle exceptions as locally as possible so that exceptions do not propagate too far up the call stack (CWE-705). Avoid unchecked or uncaught exceptions where feasible (CWE-248).
- Implementation: Ensure that error messages only contain minimal details that are useful to the intended audience and no one else. The messages need to strike the balance between being too cryptic (which can confuse users) or being too detailed (which may reveal more than intended). The messages should not reveal the methods that were used to determine the error. Attackers can use detailed information to refine or optimize their original attack, thereby increasing their chances of success. If errors must be captured in some detail, record them in log messages, but consider what could occur if the log messages can be viewed by attackers. Highly sensitive information such as passwords should never be saved to log files. Avoid inconsistent messaging that might accidentally tip off an attacker about internal state, such as whether a user account exists or not. Exposing additional information to a potential attacker in the context of an exceptional condition can help the attacker determine what attack vectors are most likely to succeed beyond DoS.
- Implementation: Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
- Architecture and Design, Implementation: If the program must fail, ensure that it fails gracefully (fails closed). There may be a temptation to simply let the program fail poorly in cases such as low memory conditions, but an attacker may be able to assert control before the software has fully exited. Alternately, an uncontrolled failure could cause cascading problems with other downstream components; for example, the program could send a signal to a downstream process so the process immediately knows that a problem has occurred and has a better chance of recovery.
- Architecture and Design: Use system limits, which should help to prevent resource exhaustion. However, the product should still handle low resource conditions since they may still occur.
References
Advisories
Packages
Other links
- cert-portal.siemens.com/productcert/html/ssa-032379.html
- git.kernel.org/stable/c/2902c3ebcca52ca845c03182000e8d71d3a5196f
- git.kernel.org/stable/c/29c0ce3c8cdb6dc5d61139c937f34cb888a6f42e
- git.kernel.org/stable/c/3439c15ae91a517cf3c650ea15a8987699416ad9
- git.kernel.org/stable/c/62708b9452f8eb77513115b17c4f8d1a22ebf843
- git.kernel.org/stable/c/c09dd3773b5950e9cfb6c9b9a5f6e36d06c62677
- lists.debian.org/debian-lts-announce/2025/10/msg00008.html
- cisa.gov/known-exploited-vulnerabilities-catalog
Timeline
- Published
- Added to CISA's Known Exploited Vulnerabilities catalog
- Remediation due for U.S. federal agencies
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| CVE-2026-53362 ipv6: account for fraggap on the paged allocation path | High Known exploited | Also affects Kernel |
| CVE-2026-53266 netfilter: bridge: make ebt_snat ARP rewrite writable | High Known exploited | Also affects Kernel |
| CVE-2026-46300 net: skbuff: preserve shared-frag marker during coalescing | High Known exploited | Also affects Kernel |
| CVE-2026-31431 crypto: algif_aead - Revert to operating out-of-place | High Known exploited | Also affects Kernel |
| CVE-2025-39964 crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg | Medium Known exploited | Also affects Kernel |
| CVE-2025-38352 posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() | High Known exploited | Also affects Kernel |
| CVE-2024-53197 ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices | High Known exploited | Also affects Kernel |
| CVE-2024-53150 ALSA: usb-audio: Fix out of bounds reads when finding clock sources | High Known exploited | Also affects Kernel |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor