Full Report
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added three security flaws impacting the Linux kernel to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The vulnerabilities are listed below - CVE-2025-39682 (CVSS score: 9.8) - An improper check for unusual or exceptional conditions vulnerability in the TLS receive path
Analysis Summary
# Vulnerability: Active Exploitation of Linux Kernel TLS and Network Flaws
## CVE Details
- **CVE ID:** CVE-2025-39682
- **CVSS Score:** 9.8 (Critical)
- **CWE:** CWE-754 (Improper Check for Unusual or Exceptional Conditions)
## Affected Systems
- **Products:** Linux Kernel
- **Versions:** Multiple versions; specific distributions such as Red Hat Enterprise Linux (RHEL) have confirmed impact.
- **Configurations:** Systems utilizing the kernel-level TLS (kTLS) receive path for encrypted traffic processing.
## Vulnerability Description
CVE-2025-39682 is an "improper check for unusual or exceptional conditions" flaw located within the Linux kernel’s TLS receive path. The vulnerability allows an authenticated local user to bypass security checks during the processing of TLS data. This can lead to unauthorized memory disclosure (reading sensitive kernel memory) or a Denial-of-Service (DoS) condition by crashing the kernel.
## Exploitation
- **Status:** **Exploited in the wild.** Added to CISA KEV catalog on September 18, 2026.
- **Complexity:** Low (Known public exploits are available).
- **Attack Vector:** Local (Requires authenticated access to the system).
## Impact
- **Confidentiality:** High (Potential memory disclosure of sensitive data).
- **Integrity:** None reported for this specific CVE (though associated flaws in the same report impact integrity).
- **Availability:** High (Can trigger system-wide Denial-of-Service/kernel panic).
## Remediation
### Patches
- Users are advised to update the Linux kernel to the latest stable version provided by their distribution (e.g., Red Hat, Debian, Ubuntu).
- **Red Hat:** Updated advisories were issued on September 19, 2026. Consult your specific vendor's security portal for version-specific patch IDs.
### Workarounds
- Disable kTLS (Kernel TLS) support if not strictly required by applications.
- Restrict local access to untrusted users on sensitive workloads.
## Detection
- **Indicators of Compromise:** Monitor for unusual kernel oops/panics specifically referencing TLS functions or memory page faults in the networking stack.
- **Detection methods and tools:**
- Use vulnerability scanners (Tenable, Qualys, or Trivy) to identify unpatched kernel versions.
- Audit system logs for exploits attempting to leverage AF_ALG or kTLS interfaces.
## References
- **CISA KEV Catalog:** hxxps[://]www[.]cisa[.]gov/known-exploited-vulnerabilities-catalog
- **Red Hat Security Advisory:** hxxps[://]access[.]redhat[.]com/security/cve/cve-2025-39682
- **CVE Program:** hxxps[://]www[.]cve[.]org/CVERecord?id=CVE-2025-39682
***
*Note: This report also references two other flaws exploited in the same campaign:*
- ***CVE-2026-53266 (CVSS 8.8):** Out-of-bounds write in ebtables (SNAT/ARP).*
- ***CVE-2025-39964 (CVSS 7.8):** Race condition in AF_ALG sockets.*