Linux Kernel TLS Flaw CVE-2025-39682 Under Active Attack

En bref

• CVE-2025-39682 affects the Linux kernel's TLS receive path.
• Three vulnerabilities total were flagged with critical severity.
• The flaws are under active exploitation and added to the KEV catalog.
• IT teams should patch affected Linux systems immediately.

In September 2026, on a Friday, three Linux kernel vulnerabilities were added to the Known Exploited Vulnerabilities (KEV) catalog. One of them, CVE-2025-39682, targets the TLS receive path. The catalog addition confirms exploitation in the wild, and the flaws carry critical severity.

These vulnerabilities impact any system running an affected Linux kernel, particularly those that process TLS traffic. For K-12 IT environments, this includes web servers, VPN gateways, and other network appliances that rely on the kernel's TLS handling. Because the kernel is foundational, patching may require coordination and downtime.

Active exploitation means attackers are already leveraging these flaws. The KEV listing obligates U.S. federal agencies to remediate by a set deadline, but the risk extends to all organizations. Critical severity suggests potential for remote code execution, denial of service, or data exposure.

The TLS receive path is a core component for encrypted communications. A flaw there could allow an attacker to bypass encryption, inject data, or crash systems. With three vulnerabilities in scope, defenders should assume broad exposure.

What to watch: Monitor Linux distributions for patched kernel versions. Check vendor advisories for CVE-2025-39682 and the other two flaws. Apply updates urgently, and consider mitigations if patching is delayed. The KEV catalog will likely be updated as more details emerge.

À faire maintenant

1. Inventory all Linux systems and appliances that handle TLS traffic.
2. Apply vendor-supplied kernel updates immediately, prioritizing internet-facing services.
3. If patching is delayed, isolate or restrict access to vulnerable TLS endpoints.
4. Monitor logs for exploitation attempts targeting the kernel's TLS receive path.
5. Subscribe to CISA KEV and Linux vendor advisories for updates on all three flaws.
6. Verify patch deployment and reboot systems as required by the kernel update.
7. Review incident response plans for signs of compromise related to these CVEs.

Références CVE

• CVE-2025-39682

Source originale

The Hacker News