CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

Linux Kernel kTLS receive-path zero-length record logic error, CISA KEV 2026-09-18, network-reachable with kernel TLS receive offload

cve · CVE-2025-39682

Coverage
1
first 2026-09-19 → last 2026-09-30
Latest activity
2026-09-19
CISA lists three separate Linux kernel bugs as exploited; Red Hat says public exploits exist, with no account…
Peak priority
notable
1 notable
Targets
public-sector
sectors: public-sector, technology
Sources cited
24
4 hosts

Action items (1)

Do-now tasks recorded on the entries about CVE-2025-39682, newest first. Check the date before acting on an older one.

  • Patch the kernel ahead of the regular cycle on Linux hosts that load the tls module (CVE-2025-39682, remotely reachable), run ebtables SNAT rules that rewrite ARP hardware addresses on a bridge (CVE-2026-53266), or give less-trusted users local access (all three); where the update must wait, block the tls module from loading or remove the ARP-rewrite SNAT rules, as Red Hat advises.
    2026-09-19CVE-2025-39682 +2

Defender insights

What each entry about CVE-2025-39682 tells a defender to do, newest first.

2026-09-19NOTABLEexploitedCISA lists three separate Linux kernel bugs as exploited; Red Hat says public exploits exist, with no account of use

Exposure

Story timeline

  1. 2026-09-19CISA KEV adds three unrelated Linux kernel flaws in one day: kTLS receive-path logic error, AF_ALG race condition, netfilter ebtables SNAT out-of-bounds write
    trending-vulnerabilitiesCISA lists three separate Linux kernel bugs as exploited; Red Hat says public exploits exist, with no account of use

Hunting pivots

Affected products
Linux Kernel
Tags
actively-exploitedcisa-kevdospriv-escvulnerabilities
ATT&CK techniques (2 across 2 tactics)

2 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v19.2 · compare on the matrix · Navigator layer (JSON)

  • Privilege EscalationExploitation for Privilege Escalation
  • ImpactEndpoint Denial of Service

Privilege Escalation TA0004

T1068Exploitation for Privilege Escalation×1

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.

Evidence: 2026-09-19/cisa-kev-linux-kernel-ktls-af-alg-ebtables-snat · ATT&CK page ↗

Impact TA0040

T1499Endpoint Denial of Service×1

Adversaries may perform Endpoint Denial of Service (DoS) attacks to degrade or block the availability of services to users. Endpoint DoS can be performed by exhausting the system resources those services are hosted on or exploiting the system to cause a persistent crash condition. Example services include websites, email services, DNS, and web-based applications. Adversaries have been observed conducting DoS attacks for political purposes and to support other malicious activities, including distraction, hacktivism, and extortion.

Evidence: 2026-09-19/cisa-kev-linux-kernel-ktls-af-alg-ebtables-snat · ATT&CK page ↗

Entries about Linux Kernel kTLS receive-path zero-length record logic error, CISA KEV 2026-09-18, network-reachable with kernel TLS receive offload (1)

2026-09-19 · view entry permalink →

NOTABLECVE-2025-39682 +2exploitedupdatedNATOA2

CISA KEV adds three unrelated Linux kernel flaws in one day: kTLS receive-path logic error, AF_ALG race condition, netfilter ebtables SNAT out-of-bounds write

CISA added three unrelated Linux kernel vulnerabilities to its Known Exploited Vulnerabilities catalog on 2026-09-18, in two separate alerts (CISA, 2026-09-18; CISA, 2026-09-18), and neither alert names a ransomware campaign, an actor, or a technical account of the exploitation behind any of the three. The Hacker News reports that Red Hat has since stated of each that "there are known public exploits leveraging this vulnerability" (The Hacker News, 2026-09-19). CVE-2025-39682 is a logic error in the kernel's TLS receive path: a zero-length record taken from the rx_list queue slips past the per-recvmsg() record-type check, a corner case the fix describes as previously unhandled, and Red Hat says it "can be remotely triggered only when kernel TLS (CONFIG_TLS with the TLS ULP) is in use" (Red Hat Product Security, 2026-09-19). CVE-2025-39964 is a race condition in the AF_ALG crypto user-API socket: concurrent sendmsg() calls to the same socket were never given exclusive-write ownership, so request payloads interleave and corrupt per-socket state, which a local user can use to crash the system or corrupt cryptographic results (Red Hat Product Security, 2026-09-19). CVE-2026-53266 is an out-of-bounds write in the netfilter bridge ebtables SNAT target, where the ARP sender-hardware-address rewrite writes directly into a socket-buffer fragment backed by a splice-imported file page (CISA KEV catalog, 2026-09-18); Red Hat rates it Important and says a local attacker on a system with such bridge rules can reach privilege escalation, memory corruption or denial of service (Red Hat Product Security, 2026-09-19). Fixed stable kernels, each confirmed in kernel.org's release ChangeLog: CVE-2025-39682 in 6.1.149, 6.6.103, 6.12.44 and 6.16.4; CVE-2025-39964 in 5.10.245, 5.15.194, 6.1.154, 6.6.108, 6.12.49 and 6.16.9; CVE-2026-53266 in 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.94, 6.18.36 and 7.0.13.

Contradiction: The Hacker News describes CVE-2025-39682 as a flaw that "could allow local authenticated users to trigger memory disclosure or denial-of-service" (The Hacker News, 2026-09-19), whereas Red Hat states it "can be remotely triggered only when kernel TLS (CONFIG_TLS with the TLS ULP) is in use" and scores the attack vector as network (Red Hat Product Security, 2026-09-19). The exposure assessment above follows Red Hat's technical account of the receive path.

CISA has added one new vulnerability to its

based on evidence of active exploitation

CISA 2026-09-18

The corner case we missed is when the initial record comes from rx_list, and it's zero length.

Red Hat Product Security 2026-09-19
Correctionrun 2026-09-20T1308Z-auditverificationsourcing_notesourcesevidencebody

Red Hat now states that public exploits exist for all three flaws. It updated its advisories for CVE-2025-39682, CVE-2025-39964 and CVE-2026-53266 on 2026-09-19 at 02:00 UTC, saying of each that "This CVE is high risk and there are known public exploits leveraging this vulnerability" and "Address this vulnerability with high priority" (The Hacker News, 2026-09-19). The earlier text stated that no vendor advisory added exploitation detail beyond the fixed kernel builds. How the flaws are being exploited, and whether they are chained, is still not described anywhere.

Correctionrun 2026-09-27T1308Z-auditcves

The severity annotation recorded for CVE-2025-39682 was wrong. Red Hat's own page for the CVE publishes a base score of 7.0 with vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H, while NVD and cve.org both publish 9.8 with AV:N/AC:L (Red Hat Product Security). The entry's second figure was recorded as 7.1, attributed to NVD rather than Red Hat, and given an AV:L local attack vector that no authority assigns. The practical consequence was a contradiction: the analysis describes a flaw reachable over the network wherever kernel TLS receive offload terminates TLS, and an AV:L annotation would have told a triage reader the opposite. Only the score annotation changes; the exploitation status, the affected and fixed kernel versions, and the analysis are unchanged.

Correctionrun 2026-09-30T0639Z-auditheadlinesummarybodytitleactionscvessourcing_notesources

Red Hat's statement is that public exploits exist, not a confirmation of in-the-wild use: it updated its advisories for all three flaws on 2026-09-19 to say "there are known public exploits leveraging this vulnerability" (The Hacker News, 2026-09-19). The Hacker News describes that update as acknowledging active exploitation, which the quoted wording does not say (The Hacker News, 2026-09-19). No source says which systems or configurations the exploitation used, so no class of Linux host can be ruled out as a target. The ebtables SNAT fix also shipped in the 7.0.13 stable kernel (kernel.org, 2026-06-19).

The Hacker News describes CVE-2025-39682 as reachable by local authenticated users (The Hacker News, 2026-09-19), while Red Hat says it can be triggered remotely where kernel TLS is in use (Red Hat Product Security, 2026-09-19). The two readings conflict, and the exposure assessment follows Red Hat's account of the receive path.

vulnerability19 Sep 04:33Zmulti-sourceOpen finding →
Sources: CISA · Red Hat Product Security · The Hacker News · kernel.org (Linux stable ChangeLog) · CISA KEV catalog

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Vulns1

Source distribution

  • cdn.kernel.org17 (71%)
  • access.redhat.com3 (12%)
  • cisa.gov3 (12%)
  • thehackernews.com1 (4%)

External references

NVD · cve.org · CISA KEV

All cited sources (24)