Impact
CISA added CVE-2025-39682 to its Known Exploited Vulnerabilities catalog on September 18, 2026, based on evidence of exploitation [S2]. The catalog describes a Linux kernel TLS receive-path flaw in which a zero-length record can bypass intended record-type handling and cause later TLS records to be processed with incorrect assumptions [S2].
Root Cause
The Linux kernel CVE record explains that recvmsg() must process either contiguous DATA records or one non-DATA record [S1]. A zero-length record retrieved from rx_list could avoid the intended handling when the record had already been decrypted, creating inconsistent zero-copy and queueing state [S1].
Affected and Fixed Versions
NVD lists affected Linux kernel ranges beginning with 6.0 and fixes in the maintained branches at 6.1.149, 6.6.103, 6.12.44, and 6.16.4; it also lists 6.17-rc1 and 6.17-rc2 as affected [S1]. Distribution kernels may backport fixes without using the same upstream version number, so administrators should follow their Linux vendor's security update guidance [S1].
Concrete Fixes
Install the corrected kernel package supplied by the operating-system or appliance vendor and reboot into that kernel [S1]. CISA directs organizations to apply vendor mitigations or discontinue unsupported affected products when mitigations are unavailable [S2].
Why FixVibe will not check this automatically
A website response does not reliably disclose the host kernel build or whether a distribution has backported the relevant fix [S1]. Repository base-image declarations also do not prove the kernel used by the eventual container host, and safely confirming the receive-path condition would require low-level TLS behavior outside FixVibe's web and repository evidence boundary [S1]. FixVibe therefore will not infer exposure from banners, Dockerfiles, or an active malformed-record probe; operators should verify the running kernel against their vendor advisory and patch inventory [S1].