CVE-2025-39682: Critical Linux Kernel TLS Flaw (KEV)

CVE-2025-39682 is a critical flaw (CVSS 9.8) in the Linux kernel TLS receive path, listed in the CISA Known Exploited Vulnerabilities catalog. It concerns zero length records on the rx_list. The fix is in the upstream stable kernels, so install the kernel update your distribution ships.

What's affected

The record lists the Linux kernel, Debian Linux, and the Siemens SIMATIC CN 4100 and its firmware. The record text does not give a version range, and the git.kernel.org pages it references were not readable when I tried them, so I cannot state affected or fixed kernel versions. Check your distribution advisory or the stable commit lists for your kernel branch.

The record does link a Debian LTS announcement from October 2025, which suggests Debian shipped updates. Read it for the exact package versions.

The flaw sits in kernel TLS, the feature that lets the kernel handle TLS record encryption and decryption for a socket. It matters only where kernel TLS is used for receiving data, but you should confirm that rather than assume.

How to check if you're exposed

Start with the running kernel and whether the TLS module is in use.

uname -r
lsmod | grep -w tls
grep -i tls /proc/net/tls_stat

The second command shows whether the tls module is loaded. The third shows kernel TLS counters, and a non zero receive counter suggests the feature is active. A missing file means kernel TLS statistics are not available on this host.

Then compare your kernel package to your vendor advisory. On Debian based systems, you can list the installed kernel images and read the changelog for the CVE id.

dpkg -l "linux-image*" | grep ^ii
apt changelog linux-image-$(uname -r) | grep -i CVE-2025-39682

For Siemens SIMATIC CN 4100 devices, use the Siemens ProductCERT advisory for the device. The record does not include it, so look it up on the Siemens site.

What to do now

1. Treat this as urgent. The record sets KEV status to true, which means CISA lists it as exploited in the wild.
2. List every Linux host, container host, appliance and embedded device in your estate, including ones that use a vendor kernel.
3. Install the kernel update from your distribution that references CVE-2025-39682, then reboot, since a kernel update does not apply to the running kernel until you do.
4. If you cannot patch at once, check whether kernel TLS is in use. If nothing needs it, unloading or blocking the tls module reduces exposure. Test this first, because some software depends on it.
5. For appliances such as the Siemens device, follow the vendor advisory and limit network access to the device until the update is applied.
6. Confirm the new kernel is running with uname -r on each host.

Why it matters

The record maps the issue to CWE-754, improper check for unusual or exceptional conditions. The kernel commit message explains the corner case. A receive call must handle either data records or one non data record. A zero length record that came from the rx_list, the queue of already decrypted records, was not handled in the way the code assumed. The result is that the kernel mishandles a record it should have treated differently.

The CVSS score of 9.8 reflects network access, no privileges and high impact on confidentiality, integrity and availability. Kernel bugs are serious because the kernel runs with the highest privileges on the host. This CVE is on the CISA KEV list, so do not rank it by score alone. It is known to be used.

A kernel patch is a different job from a library upgrade. It touches every host and needs a reboot plan. Our free in-browser dependency scan covers application dependencies, and the Gold directory lists this CVE, so you can track it with the rest of your inventory. Reachability analysis helps for application libraries, but for the kernel the question is simpler: is the host patched or not?

Try it yourself

Click through it at your own pace, or open it full screen.

Quick check

Sources

• Gold entry for CVE-2025-39682
• Debian LTS announcement listed in the record
• Kernel stable commit listed in the record

The kernel and Debian pages sat behind a bot check when I tried them, so the description above comes from the CVE record text. Read the primary pages for version details.

Last reviewed: 18 October 2026.