CISA Flags CVE-2025-39682 Linux Kernel TLS Flaw as Exploited

Executive Summary

The U.S. Cybersecurity and Infrastructure Security Agency has added CVE-2025-39682, a Linux kernel flaw in the TLS receive path, to its Known Exploited Vulnerabilities catalog, citing evidence of active exploitation. The vulnerability carries a CVSS score of 9.8 — the highest severity band — and stems from an improper check for unusual or exceptional conditions in how the kernel handles inbound TLS records.

For defenders, the KEV listing is the operative signal: this is no longer a theoretical kernel bug awaiting a proof-of-concept. Federal civilian agencies are now bound by CISA's remediation timeline, and any organization running an unpatched kernel on a TLS-terminating host should treat the exposure as live. The vulnerability is one of three Linux kernel flaws CISA added to KEV in the same action.

Technical Analysis

CVE-2025-39682 is classified as an improper check for unusual or exceptional conditions vulnerability in the TLS receive path. In the Linux kernel's kTLS implementation, the receive path parses inbound TLS records and hands decrypted payloads up the stack. A missing or incorrect validation of an exceptional condition in that path means a crafted record can drive the kernel into a state the code did not anticipate.

The CVSS base score of 9.8 reflects the standard profile for a remotely reachable, unauthenticated, low-complexity flaw with high confidentiality, integrity, and availability impact. CISA's KEV entry confirms that at least one adversary has already converted that theoretical reachability into real-world exploitation.

CISA has not published the specific exploit chain, the targeted kernel versions, or the identity of the exploiting actor in the KEV entry itself. The advisory does not name a threat group, does not publish indicators of compromise, and does not describe the post-exploitation behavior observed in the wild. Those details remain unattributed in the source material, and defenders should not assume the exploitation is limited to a single campaign or sector.

The two companion flaws added to KEV in the same action are not identified by CVE ID in the source material reviewed here, so this article does not enumerate them. Readers tracking the full batch should consult the KEV catalog directly rather than relying on secondary summaries.

Mitigations & Recommendations

CISA's KEV addition imposes a binding remediation deadline on U.S. federal civilian executive branch agencies. Private-sector defenders should treat the same deadline as a reasonable prioritization target, given the confirmed in-the-wild exploitation and the 9.8 severity.

The practical action is to identify every host running a Linux kernel with the kTLS receive path enabled — TLS-terminating load balancers, reverse proxies, service meshes, and any workload using kernel TLS offload — and confirm the running kernel version against the vendor's fixed release. Because the flaw sits in the receive path, hosts that only originate TLS connections are lower priority than hosts that accept them.

Where immediate kernel patching is not operationally possible, defenders should consider disabling kTLS on exposed listeners and terminating TLS in userspace until the kernel can be updated. Monitoring should focus on kernel-level anomalies on TLS-terminating hosts: unexpected crashes, oops messages, or privilege transitions originating from network-facing processes. Because CISA has not published IOCs, detection must be built from host telemetry rather than from a fixed indicator list.