Severity: Critical
A critical vulnerability has been disclosed affecting the Linux kernel’s Transport Layer Security (TLS) subsystem, impacting Linux distributions commonly used across enterprise, cloud and financial infrastructure environments.
The vulnerability, tracked as CVE-2025-39682, is a vulnerability in the Linux kernel’s TLS (Transport Layer Security) subsystem, specifically in the handling of zero-length records on the receive list (rx_list) during TLS socket processing. A flaw in the way the kernel’s TLS implementation manages record type transitions during recvmsg() calls means that when an initial record is pulled from the rx_list and is zero-length, the code can attempt to queue a socket buffer (skb) to the rx_list after a zero-copy decrypt operation — a state that is not valid, as the data has already been decrypted directly into user space memory and no skb is available to queue. This inconsistency in internal kernel state can lead to memory corruption or other unpredictable kernel behaviour, potentially allowing a locally authenticated attacker to cause a denial of service (kernel crash) or escalate privileges on the affected host. This vulnerability has been added to the CISA Known Exploited Vulnerabilities (KEV) catalogue.
As part of Beeks’ commitment to supporting operational resilience and cyber risk management, this advisory is intended to help organisations assess exposure and implement appropriate mitigations.
Affected software:
- Linux kernel (TLS subsystem, rx_list zero-length record handling)
- Ubuntu 20.04 – 25.04
- Red Hat Enterprise Linux 8 – 9
Immediate Actions Required:
- Apply the latest kernel patch provided by your Linux distribution vendor to remediate this vulnerability — this is the primary and most effective remediation.
- Reboot affected systems after patching, as kernel updates do not take effect until the system is restarted unless a live patching service is in use.
- Confirm remediation by verifying the running kernel version with “uname -r” and comparing it against the fixed version published by your vendor.
- Where patching is not immediately possible, restrict local and shell access to trusted administrators only, and limit exposure of TLS socket functionality to untrusted or unprivileged users.
- Monitor vendor security channels and the CISA Known Exploited Vulnerabilities catalogue for updated guidance and indicators of active exploitation as they become available.
Further Information:
For detailed information on the vulnerability, please refer to the following sources:
https://nvd.nist.gov/vuln/detail/CVE-2025-39682
https://git.kernel.org/stable/c/2902c3ebcca52ca845c03182000e8d71d3a5196f
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-39682
If you have any questions or require further assistance, please contact [email protected] or reach out to your Beeks account representative.
This advisory is issued to help ensure the security of your systems and prevent unauthorised access to sensitive data. Beeks remains committed to providing timely security information and support to safeguard your infrastructure.
Beeks will continue to monitor this and related vulnerabilities and provide updates through our Security Advisory Feed.
