CVE-2025-39682 Linux Kernel Improper Check for Unusual or Exceptional Conditions
A flaw in Linux kernel TLS handling of zero-length records can cause a denial of service by breaking the receive message processing loop.
- Exploited in the wild
- Since 18 Sep 2026
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-39682?
CVE-2025-39682 is a critical denial of service vulnerability in Debian Debian Linux, published on 5 Sep 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
tls: fix handling of zero-length records on the rx_list
Each recvmsg() call must process either - only contiguous DATA records (any number of them) - one non-DATA record
If the next record has different type than what has already been processed we break out of the main processing loop. If the record has already been decrypted (which may be the case for TLS 1.3 where we don't know type until decryption) we queue the pending record to the rx_list. Next recvmsg() will pick it up from there.
Queuing the skb to rx_list after zero-copy decrypt is not possible, since in that case we decrypted directly to the user space buffer, and we don't have an skb to queue (darg.skb points to the ciphertext skb for access to metadata like length).
Only data records are allowed zero-copy, and we break the processing loop after each non-data record. So we should never zero-copy and then find out that the record type has changed. The corner case we missed is when the initial record comes from rx_list, and it's zero length.
Weakness: CWE-754
Which versions are affected by CVE-2025-39682?
It affects 3 products.
Products include Debian Debian Linux, Linux kernel, Siemens Simatic Cn 4100 Firmware.
How do I fix CVE-2025-39682?
Apply the vendor's patch. US federal agencies must fix it by 21 Sep 2026.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-39682 being exploited?
Yes. Attackers have exploited CVE-2025-39682 in the wild since at least 18 Sep 2026.
Public exploit code: 2 proofs of concept on GitHub.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as A-440544511, ASB-A-440544511, AZL-67001, BELL-CVE-2025-39682, DEBIAN-CVE-2025-39682, GHSA-v2pf-75pf-9c5h and 4 more.