← Back to CVE Explorer

CVE-2025-39682

Full vulnerability record from the local CVENow database.

Description

In the Linux kernel, the following vulnerability has been resolved: tls: fix handling of zero-length records on the rx_list Each recvmsg() call must process either - only contiguous DATA records (any number of them) - one non-DATA record If the next record has different type than what has already been processed we break out of the main processing loop. If the record has already been decrypted (which may be the case for TLS 1.3 where we don't know type until decryption) we queue the pending record to the rx_list. Next recvmsg() will pick it up from there. Queuing the skb to rx_list after zero-copy decrypt is not possible, since in that case we decrypted directly to the user space buffer, and we don't have an skb to queue (darg.skb points to the ciphertext skb for access to metadata like length). Only data records are allowed zero-copy, and we break the processing loop after each non-data record. So we should never zero-copy and then find out that the record type has changed. The corner case we missed is when the initial record comes from rx_list, and it's zero length.

Severity
CRITICAL
CVSS score
9.8 (v3.1)
Vulnerability status
Analyzed
Source identifier
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Published
2025-09-05 18:15:44.670000
Last modified
2026-10-19 21:10:00.160000
View original CVE JSON 
{
  "id": "CVE-2025-39682",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "published": "2025-09-05T18:15:44.670",
  "lastModified": "2026-10-19T21:10:00.160",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntls: fix handling of zero-length records on the rx_list\n\nEach recvmsg() call must process either\n - only contiguous DATA records (any number of them)\n - one non-DATA record\n\nIf the next record has different type than what has already been\nprocessed we break out of the main processing loop. If the record\nhas already been decrypted (which may be the case for TLS 1.3 where\nwe don't know type until decryption) we queue the pending record\nto the rx_list. Next recvmsg() will pick it up from there.\n\nQueuing the skb to rx_list after zero-copy decrypt is not possible,\nsince in that case we decrypted directly to the user space buffer,\nand we don't have an skb to queue (darg.skb points to the ciphertext\nskb for access to metadata like length).\n\nOnly data records are allowed zero-copy, and we break the processing\nloop after each non-data record. So we should never zero-copy and\nthen find out that the record type has changed. The corner case\nwe missed is when the initial record comes from rx_list, and it's\nzero length."
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ntls: soluciona el manejo de registros de longitud cero en la rx_list\n\nCada llamada a recvmsg() debe procesar o bien\n- solo registros DATA contiguos (cualquier número de ellos)\n- un registro que no sea DATA\n\nSi el siguiente registro tiene un tipo diferente al que ya ha sido procesado, salimos del bucle de procesamiento principal. Si el registro ya ha sido descifrado (lo cual puede ocurrir con TLS 1.3 donde no conocemos el tipo hasta el descifrado), ponemos en cola el registro pendiente en la rx_list. La siguiente recvmsg() lo recogerá de ahí.\n\nPoner en cola el skb en la rx_list después del descifrado de copia cero no es posible, ya que en ese caso desciframos directamente al búfer del espacio de usuario, y no tenemos un skb para poner en cola (darg.skb apunta al skb del texto cifrado para acceder a metadatos como la longitud).\n\nSolo a los registros de datos se les permite la copia cero, y rompemos el bucle de procesamiento después de cada registro que no sea de datos. Así que nunca deberíamos hacer copia cero y luego descubrir que el tipo de registro ha cambiado. El caso excepcional que pasamos por alto es cuando el registro inicial proviene de la rx_list, y es de longitud cero."
    }
  ],
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "programFiles": [
            "net/tls/tls_sw.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "84c61fe1a75b4255df1e1e7c054c9e6d048da417",
              "lessThan": "2902c3ebcca52ca845c03182000e8d71d3a5196f",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "84c61fe1a75b4255df1e1e7c054c9e6d048da417",
              "lessThan": "c09dd3773b5950e9cfb6c9b9a5f6e36d06c62677",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "84c61fe1a75b4255df1e1e7c054c9e6d048da417",
              "lessThan": "3439c15ae91a517cf3c650ea15a8987699416ad9",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "84c61fe1a75b4255df1e1e7c054c9e6d048da417",
              "lessThan": "29c0ce3c8cdb6dc5d61139c937f34cb888a6f42e",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "84c61fe1a75b4255df1e1e7c054c9e6d048da417",
              "lessThan": "62708b9452f8eb77513115b17c4f8d1a22ebf843",
              "versionType": "git",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "programFiles": [
            "net/tls/tls_sw.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "6.0",
              "status": "affected"
            },
            {
              "version": "0",
              "lessThan": "6.0",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.1.149",
              "lessThanOrEqual": "6.1.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.6.103",
              "lessThanOrEqual": "6.6.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.12.44",
              "lessThanOrEqual": "6.12.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.16.4",
              "lessThanOrEqual": "6.16.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.17",
              "lessThanOrEqual": "*",
              "versionType": "original_commit_for_fix",
              "status": "unaffected"
            }
          ]
        }
      ]
    },
    {
      "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
      "affectedData": [
        {
          "vendor": "Siemens",
          "product": "SIMATIC CN 4100",
          "defaultStatus": "unknown",
          "versions": [
            {
              "version": "0",
              "lessThan": "V5.0",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9
      },
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-09-19T03:56:25.358027Z",
          "id": "CVE-2025-39682",
          "options": [
            {
              "exploitation": "active"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "cisaExploitAdd": "2026-09-18",
  "cisaActionDue": "2026-09-21",
  "cisaRequiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
  "cisaVulnerabilityName": "Linux Kernel Improper Check for Unusual or Exceptional Conditions Vulnerability",
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-754"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "6.0",
              "versionEndExcluding": "6.1.149",
              "matchCriteriaId": "DE30211F-1A6B-457E-B19D-D3E385550199"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "6.2",
              "versionEndExcluding": "6.6.103",
              "matchCriteriaId": "F2293654-7169-49B5-8D0D-EE51EF8B8E48"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "6.7",
              "versionEndExcluding": "6.12.44",
              "matchCriteriaId": "12351F24-1133-4775-960C-F2B47E81298B"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "6.13",
              "versionEndExcluding": "6.16.4",
              "matchCriteriaId": "AFC28995-B8C3-4B68-8CB6-78E792B6629D"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc1:*:*:*:*:*:*",
              "matchCriteriaId": "327D22EF-390B-454C-BD31-2ED23C998A1C"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc2:*:*:*:*:*:*",
              "matchCriteriaId": "C730CD9A-D969-4A8E-9522-162AAF7C0EE9"
            }
          ]
        }
      ]
    },
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED"
            }
          ]
        }
      ]
    },
    {
      "operator": "AND",
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:siemens:simatic_cn_4100_firmware:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "5.0",
              "matchCriteriaId": "AA9D4F6E-9336-4026-B485-4227C861B356"
            }
          ]
        },
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": false,
              "criteria": "cpe:2.3:h:siemens:simatic_cn_4100:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "92619F5F-3679-4424-9455-3285FF1EF2F1"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/2902c3ebcca52ca845c03182000e8d71d3a5196f",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://git.kernel.org/stable/c/29c0ce3c8cdb6dc5d61139c937f34cb888a6f42e",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://git.kernel.org/stable/c/3439c15ae91a517cf3c650ea15a8987699416ad9",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://git.kernel.org/stable/c/62708b9452f8eb77513115b17c4f8d1a22ebf843",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://git.kernel.org/stable/c/c09dd3773b5950e9cfb6c9b9a5f6e36d06c62677",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ]
    },
    {
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html",
      "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
      "tags": [
        "Third Party Advisory"
      ]
    },
    {
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-39682",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "US Government Resource"
      ]
    }
  ]
}