CVE-2025-39682 is a Linux kernel TLS (kernel TLS offload) flaw in which the rx_list queue can end up holding a mix of zero-length and data records that recvmsg() does not correctly separate, corrupting TLS record processing; CISA added it to the KEV catalog in September 2026 and NVD rates it 9.8 critical with its own Primary score.
Vulnerability summary
9.8
Critical
3.3%
EPSS score (FIRST)
Yes
CISA KEV catalog
2025-09-05
Published
Vulnerability ID: CVE-2025-39682 · Source: NVD
Affected components
| Component | CPE | Version range |
|---|---|---|
| Linux Kernel | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 6.0 through <6.1.149; 6.2 through <6.6.103; 6.7 through <6.12.44; 6.13 through <6.16.4; 6.17-rc1 and 6.17-rc2 |
| Siemens SIMATIC CN 4100 | cpe:2.3:o:siemens:simatic_cn_4100_firmware:*:*:*:*:*:*:*:* | < 5.0 (bundles an affected Linux kernel; fixed per Siemens SSA-032379) |
What this means
CVE-2025-39682 is a vulnerability in the Linux kernel's in-kernel TLS (kTLS) implementation, fixed upstream under the commit description "tls: fix handling of zero-length records on the rx_list." NVD's description states the invariant that "each recvmsg() call must process either only contiguous DATA records (any number of them) or one non-DATA record" — a crafted sequence that mixes a zero-length record with other records on the rx_list queue breaks that invariant (NVD).
NVD has completed its own analysis and published a Primary CVSS v3.1 score of 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — network-reachable, low complexity, no privileges or user interaction, high impact to confidentiality, integrity and availability. The CNA-submitted score agrees at the same 9.8 value. NVD's own weakness mapping is "NVD-CWE-Other," while the CISA-submitted ADP mapping is CWE-754 (Improper Check for Unusual or Exceptional Conditions) (NVD).
CISA added CVE-2025-39682 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-09-18 with a required-action due date of 2026-09-21, describing it as "a flaw in the TLS receive path permitting a zero-length record to circumvent recvmsg() record-type handling, potentially disrupting subsequent TLS record processing." Known ransomware campaign use is listed as "Unknown" (CISA KEV).
NVD's CPE applicability data lists affected mainline kernel ranges of 6.0 through 6.1.148, 6.2 through 6.6.102, 6.7 through 6.12.43, 6.13 through 6.16.3, and the 6.17 release candidates, with fixes delivered via a set of stable-tree commits on git.kernel.org. The same CPE configuration also names Siemens SIMATIC CN 4100 firmware before version 5.0 as affected, because that product embeds a vulnerable kernel; Siemens' own advisory SSA-032379 confirms the device and points to the version 5.0 firmware update as the fix (NVD, Siemens SSA-032379).
FIRST EPSS currently scores the probability of exploitation at 0.0325 (88.3rd percentile) as of 2026-10-30 — notably lower than the raw CVSS severity would suggest, consistent with a kernel-internal TLS race that is harder to weaponize at scale than a simple unauthenticated web RCE, even though CISA has evidence of it being actively exploited in at least some environments (FIRST EPSS).
Operators should apply the vendor kernel updates (or the relevant distribution's backported fix) for any system in the affected ranges, with particular attention to Siemens SIMATIC CN 4100 deployments on operational-technology networks, which should also follow standard OT network segmentation practice while patching is scheduled.
Evidence
- The Linux kernel TLS rx_list queue can end up with a disallowed mix of zero-length and data records, breaking the recvmsg() invariant that each call process only contiguous DATA records or one non-DATA record. — NVD
- NVD Primary CVSS v3.1 base score is 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, matching the CNA-submitted score; NVD weakness mapping is NVD-CWE-Other, CISA ADP mapping is CWE-754. — NVD
- Added to the CISA KEV catalog on 2026-09-18, due date 2026-09-21, known ransomware use listed as Unknown. — CISA KEV
- Affected mainline kernel ranges 6.0-6.1.148, 6.2-6.6.102, 6.7-6.12.43, 6.13-6.16.3, 6.17-rc1/rc2, fixed via stable-tree patches; Siemens SIMATIC CN 4100 firmware before 5.0 also affected because it embeds a vulnerable kernel. — NVD
- Siemens SIMATIC CN 4100 is confirmed affected, fixed in firmware version 5.0. — Siemens SSA-032379
- EPSS score is 0.0325 (88.3rd percentile) as of 2026-10-30. — FIRST EPSS
