CVE-2025-39682 · High · CISA KEV

Linux Kernel TLS Vulnerability: Zero-Length Record Bypass Leads to Incorrect Processing

Threat Engine Auto-Feed · data current as of 2026-09-19

A vulnerability in the Linux Kernel's TLS receive path allows a zero-length record to bypass intended handling, potentially causing subsequent TLS records to be processed incorrectly. This flaw, listed in CISA KEV, indicates active exploitation. Organizations using affected Linux Kernel versions are at risk of data processing errors and potential security bypasses.

  • CVSS:
  • EPSS percentile: 0.66794
  • Exploitation pressure: 65/100 (High)

Exploitation reality: listed in CISA KEV (exploited in the wild) · EPSS 67th percentile. Threat × Vulnerability from public signals — impact depends on your environment.

Weakness —

This vulnerability is an 'improper check for unusual or exceptional conditions.' It means the software fails to correctly handle an unexpected or rare input, specifically a zero-length record in the TLS receive path. This misstep can lead to the system making incorrect assumptions about how to process subsequent data, potentially causing data corruption or security issues.

Who's at risk

Exposure: unknown · Auth: unknown · unknown

Enterprise profiles most at risk

  • Any enterprise utilizing Linux Kernel, especially those with critical TLS-encrypted communications
  • Financial services, due to documented targeting by FIN7, LockBit affiliates, and APT38
  • Technology sector, due to documented targeting by APT29 and Scattered Spider

Misconfigurations that escalate it

  • Continued use of end-of-life (EoL) or end-of-service (EoS) Linux Kernel versions
  • Lack of robust monitoring for unusual TLS record processing or errors

High-impact scenarios

  • Incorrect processing of sensitive TLS-encrypted data, leading to data integrity issues or exposure
  • Bypass of intended security controls within the TLS receive path
  • Disruption of critical services relying on secure TLS communication

Likely adversaries

  • FIN7 — Financial services (Assessed)
  • LockBit affiliates — Financial services (Assessed)
  • APT38 (Lazarus) — Financial services (Assessed)
  • APT29 (Cozy Bear) — Technology (Assessed)
  • Scattered Spider — Technology (Assessed)

What to do (defensive)

Detect

  • Monitor system logs for unusual TLS errors or warnings related to record processing
  • Implement network intrusion detection systems (NIDS) to identify anomalous TLS traffic patterns or malformed records
  • Regularly audit Linux Kernel versions in use across the environment

Contain

  • Isolate systems running affected Linux Kernel versions from critical networks
  • Temporarily disable services relying on TLS if immediate patching is not feasible and risk is high

Patch

  • Identify and upgrade all affected Linux Kernel instances to a supported, patched version
  • Discontinue use of end-of-life (EoL) and end-of-service (EoS) Linux Kernel versions and transition to supported alternatives

Frontier verdict — High

High priority due to active exploitation (CISA KEV) and potential for critical TLS data processing errors across various sectors.

For detection-engineering and awareness only · point-in-time · not security advice · sourced from NVD, FIRST EPSS, CISA KEV. Adversary mappings are assessments unless cited.