Is CVE-2025-39682 exploited in the wild?

Yes. CVE-2025-39682 is known to be exploited in the wild, first recorded on 18 September 2026. Treat it as urgent.

How severe is CVE-2025-39682?

Critical severity, with a CVSS score of 9.8, published 5 September 2025.

Which products and versions are affected?

Linux Kernel 6.0 to 6.1.149, 6.2 to 6.6.103, 6.7 to 6.12.44, 6.13 to 6.16.4; Linux Kernel 6.0 to 6.1.149, 6.6.103, 6.12.44; Siemens SIMATIC CN 4100 < V5.0.

Is there a fix for CVE-2025-39682?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2025-39682 attacked?

It is attacked over the network, in an operating system.

Am I affected by CVE-2025-39682?

Check whether you run Linux Kernel, Linux Kernel or Siemens SIMATIC CN 4100 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-39682: Linux Kernel memory corruption in TLS zero-length record handling

Q: Is there a fix for CVE-2025-39682?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2025-39682 attacked?

It is attacked over the network, in an operating system.

Q: Am I affected by CVE-2025-39682?

Check whether you run Linux Kernel, Linux Kernel or Siemens SIMATIC CN 4100 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-39682 · Severity: critical · CVSS 9.8 · Exploited in the wild · Published 2025-09-05

The Linux Kernel has a vulnerability that improperly handles unusual or exceptional conditions, allowing attackers to exploit systems in active attacks. This vulnerability is being actively exploited by threat actors in the wild and has been flagged by CISA as a high-priority risk requiring immediate patching by government agencies and critical infrastructure operators. Organizations are urged to prioritize remediation as part of their risk-based vulnerability management programs.

Technologies: Linux Kernel, Siemens SIMATIC CN 4100. Vendors: Linux, Siemens.

Quick answers

Is CVE-2025-39682 exploited in the wild?: Yes. CVE-2025-39682 is known to be exploited in the wild, first recorded on 18 September 2026. Treat it as urgent.
How severe is CVE-2025-39682?: Critical severity, with a CVSS score of 9.8, published 5 September 2025.
Which products and versions are affected?: Linux Kernel 6.0 to 6.1.149, 6.2 to 6.6.103, 6.7 to 6.12.44, 6.13 to 6.16.4; Linux Kernel 6.0 to 6.1.149, 6.6.103, 6.12.44; Siemens SIMATIC CN 4100 < V5.0.
Is there a fix for CVE-2025-39682?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-39682 attacked?: It is attacked over the network, in an operating system.
Am I affected by CVE-2025-39682?: Check whether you run Linux Kernel, Linux Kernel or Siemens SIMATIC CN 4100 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

CVE-2025-39682 is classified as an improper check for unusual or exceptional conditions in the Linux Kernel, which falls under the class of logic errors or missing validation in kernel-level code. The vulnerability allows attackers to exploit systems when exceptional conditions are not properly validated or handled. The attack vector is network-accessible given the kernel's direct exposure to network packets and system calls. Exploitation of this kernel vulnerability can result in complete system compromise, including arbitrary code execution and denial of service. CISA added this to the KEV Catalog based on confirmed evidence of active exploitation in the wild; however, specific patch availability and kernel versions affected are not detailed in this advisory.

Affected products

Linux Linux Kernel

Timeline

2026-09-18: kev added: Added to CISA Known Exploited Vulnerabilities Catalog based on evidence of active exploitation

References

https://www.cisa.gov/news-events/alerts/2026/09/18/cisa-adds-one-known-exploited-vulnerability-catalog

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.