Junglewise Threat Intelligence

CVE-2025-39682: Linux Kernel memory corruption in TLS zero-length record handling

CVE-2025-39682 · Severity: critical · CVSS 9.8 · Exploited in the wild · Published 2025-09-05

Technologies: Linux Kernel, Siemens SIMATIC CN 4100. Vendors: Linux, Siemens.

Executive brief

The Linux Kernel has a vulnerability that improperly handles unusual or exceptional conditions, allowing attackers to exploit systems in active attacks. This vulnerability is being actively exploited by threat actors in the wild and has been flagged by CISA as a high-priority risk requiring immediate patching by government agencies and critical infrastructure operators. Organizations are urged to prioritize remediation as part of their risk-based vulnerability management programs.

Technical details

CVE-2025-39682 is classified as an improper check for unusual or exceptional conditions in the Linux Kernel, which falls under the class of logic errors or missing validation in kernel-level code. The vulnerability allows attackers to exploit systems when exceptional conditions are not properly validated or handled. The attack vector is network-accessible given the kernel's direct exposure to network packets and system calls. Exploitation of this kernel vulnerability can result in complete system compromise, including arbitrary code execution and denial of service. CISA added this to the KEV Catalog based on confirmed evidence of active exploitation in the wild; however, specific patch availability and kernel versions affected are not detailed in this advisory.

Affected products

  • Linux Linux Kernel

Timeline

  • 2026-09-18: kev added: Added to CISA Known Exploited Vulnerabilities Catalog based on evidence of active exploitation

References

Related threats