CISA adds Linux kernel TLS flaw to exploited-vulnerabilities catalogue

CISA added CVE-2025-39682, a Linux kernel flaw in the TLS receive path, to its Known Exploited Vulnerabilities catalogue on 18 September 2026, citing evidence of active exploitation. The entry carries a 21 September due date and requires forensic triage under BOD 26-04, the directive covering Federal Civilian Executive Branch agencies.^[1]^[2]

What we know

CISA’s KEV catalogue describes CVE-2025-39682 as an improper check for unusual or exceptional conditions in the Linux kernel’s TLS receive path. A zero-length record retrieved from the rx_list can bypass the intended recvmsg() record-type handling, which can cause later TLS records to be processed under incorrect zero-copy and queuing assumptions.^[2]

The catalogue lists a date-added of 18 September 2026 and a due date of 21 September 2026, and marks forensic triage as required under BOD 26-04. The catalogue also states that affected products could be end of life or end of service, and advises users to move to a supported version where that applies.^[2]

CISA’s alert confirms the addition was made on evidence of active exploitation and repeats that BOD 26-04 sets vulnerability management requirements for federal civilian agencies, while encouraging other organisations to prioritise KEV entries through their own risk-based process.^[1]^[3]

What we don’t know

The public notices do not state how many systems were targeted, which kernel versions or distributions were actually exploited in practice, or what an attacker achieved once the record-handling flaw was triggered. CISA marks ransomware use as unknown rather than confirmed absent.^[2]

Neither the alert nor the catalogue entry names an attacker, a campaign, or a victim. The stable kernel commits referenced in the catalogue’s notes were not independently accessible for this article, so the exact patched code path is described here only at the level the catalogue itself states.^[2]

Why it matters

A KEV addition is a signal that CISA has evidence of exploitation, not a measurement of scale. BOD 26-04 itself states the link directly: Appendix A, Table 1, footnote 4 says the “& forensic triage” designation means an agency “must complete remediation or mitigation action within the timeline (three days) and carry out a forensic triage of the asset to assess whether the system is compromised.”^[2]^[3] Read alongside the catalogue’s “Forensic triage required” flag, that primary-source text ties the 21 September due date to forensic triage as a single combined obligation, not merely a simple upgrade window.^[2]^[3]

Data-led infographic on CVE-2025-39682: CISA added the Linux kernel TLS receive-path flaw to its KEV catalogue on 18 September 2026; scoping begins within roughly two hours of the KEV addition, before the BOD 26-04 due date of 21 September 2026 which requires forensic triage; the vulnerability is CWE-754, a zero-length record bypassing recvmsg() record-type handling; the requirement binds Federal Civilian Executive Branch agencies and ransomware use is recorded as unknown, not confirmed absent. — Corrected timeline: scoping begins within roughly two hours of the KEV addition, before the BOD 26-04 forensic-triage due date three days later. Editorial timeline built from CISA’s own catalogue and directive guidance, not an official CISA graphic.

What the KEV entry actually says

CISA’s catalogue entry for CVE-2025-39682 is narrow and technical. It describes an improper check for unusual or exceptional conditions in the kernel’s TLS receive path: a zero-length record pulled from the rx_list can slip past the recvmsg() logic meant to classify record types, after which later TLS records may be handled under mismatched zero-copy and queuing assumptions.^[2] That is a kernel networking defect, not a description of an exploit chain, a proof-of-concept, or a specific attack observed against a named target.

The entry assigns the related weakness as CWE-754, the general improper-check-for-exceptional-conditions category, and records the addition date as 18 September 2026 and the due date as 21 September 2026.^[2] It also flags that impacted products could be end of life or end of service, advising a move to a supported version where that condition applies, and records ransomware use as unknown rather than ruled out.^[2]

CISA’s companion alert states plainly that the addition follows evidence of active exploitation, without elaborating on how that exploitation was detected or by whom.^[1] Read0nly could not independently verify the underlying exploitation telemetry; the claim rests on CISA’s own attribution as the cataloguing authority.

Why the deadline is a forensic one, not just a patch window

The obligation attached to this entry sits under BOD 26-04, Prioritizing Security Updates Based on Risk, which took effect this year and requires Federal Civilian Executive Branch agencies to prioritise remediation of KEV-listed vulnerabilities on internet-exposed assets.^[3] That directive replaced the older BOD 22-01, which is now marked revoked and superseded.^[5] The distinction is practically important: CISA’s implementation guidance for BOD 26-04 sets out forensic triage steps, starting with scoping the affected assets within roughly two hours of a KEV addition, then preserving volatile evidence before any patching or containment action that could destroy it.^[4]

That sequencing means the 21 September due date is not simply a target for applying a kernel update. The catalogue marks forensic triage as required for this specific entry, so agencies are also expected to determine whether systems were compromised before the fix was applied, following the scoping, evidence-preservation, patching, containment, and analysis steps the guidance lays out.^[2]^[4] BOD 26-04 applies only to FCEB agencies, but CISA’s alert separately encourages all organisations to treat KEV entries as an input to their own risk-based vulnerability management, which is a recommendation rather than a binding requirement outside the federal civilian branch.^[1]

What remains open

The published record does not establish the exploitation’s scope, method of delivery, or whether it depends on a specific network configuration, TLS library pairing, or kernel build. The catalogue’s own notes point to several kernel.org stable commits as the technical fix references, which is consistent with a defect already addressed in current stable kernel branches, but this article did not obtain independent access to that commit history to describe the patch mechanics beyond what CISA’s summary states. The catalogue’s notes also link to the CVE’s NVD and CVE.org records; both were also attempted for this article and returned client-side loading shells rather than accessible technical detail, so none of the three customary independent technical-detail sources for this CVE were reachable.^[2]

The catalogue’s end-of-life/end-of-service caveat and its forensic-triage and ransomware-unknown flags read as standard fields CISA populates across many KEV entries generically, rather than bespoke findings specific to CVE-2025-39682, so they should not be over-weighted as CVE-specific research conclusions.

The 21 September deadline applies to federal agencies operating affected, internet-exposed assets. It does not, by itself, indicate that every Linux system running the vulnerable code path is under active attack, and CISA’s own catalogue entry is the only public source establishing the exploitation claim at the time of writing.^[1]^[2]