CISA Adds Actively Exploited Linux Kernel TLS Flaw to KEV Catalog

En bref

• CISA added three Linux kernel vulnerabilities to its Known Exploited Vulnerabilities catalog, citing active exploitation.
• One listed flaw, CVE-2025-39682, has a CVSS score of 9.8 and affects the TLS receive path.
• Linux-based servers, appliances, and endpoints may be at risk depending on kernel version and exposure.
• A KEV listing means defenders should treat patching as urgent, not theoretical.
• Verify the other two CVEs and affected versions through CISA and vendor advisories.

CISA has expanded its catalog of bugs known to be exploited in the wild with three Linux kernel issues. One of them, CVE-2025-39682, carries a CVSS score of 9.8 and involves an improper check for unusual or exceptional conditions in the TLS receive path. The advisory excerpt does not name the other two CVEs or their affected code paths, so those details should be confirmed through CISA and Linux distribution advisories.

The Linux kernel sits under many systems that schools and government agencies rely on: physical and virtual servers, containers, firewalls, VPN concentrators, web proxies, and other network appliances. Any service that terminates or inspects TLS traffic may be especially relevant because the known flaw is in the TLS receive path. The exact exposure depends on whether the vulnerable kernel code is reachable and whether an attacker can send crafted traffic to it.

Active exploitation changes the priority. A KEV listing means defenders should assume the flaw is not merely theoretical and that public or targeted exploitation has occurred. A 9.8 severity score suggests a serious impact if exploited, though the precise outcome depends on the vulnerable path and the attacker's access. For K-12 environments, affected systems could include identity services, web filtering, remote access, and internal application servers.

Because Linux fixes are delivered through distributions and appliance vendors, administrators should not wait for a single upstream patch. They should inventory kernel versions, map them to vendor advisories, and apply fixed builds or firmware. Watch for updates on the other two CVEs, vendor patch availability, and any CISA remediation deadlines. If immediate patching is not possible, reduce exposure and monitor for unusual TLS or kernel behavior.

À faire maintenant

1. Retrieve the CISA KEV entry and record all three CVEs, including CVE-2025-39682, then check each against vendor advisories.
2. Inventory Linux kernel versions across servers, virtual machines, containers, network appliances, and security gateways.
3. Apply vendor-supplied kernel or firmware updates for CVE-2025-39682 and the other two flaws as soon as fixed versions are available.
4. Prioritize internet-facing TLS endpoints such as VPNs, reverse proxies, load balancers, email gateways, and web filters.
5. If patching is delayed, restrict management access, segment affected systems, and add monitoring for unusual TLS or kernel activity.
6. Track CISA and Linux distribution updates for the remaining CVE details and any required remediation deadlines.
7. Verify backups and incident response procedures in case exploitation is suspected, and preserve logs for investigation.

Références CVE

• CVE-2025-39682

Source originale

The Hacker News