CISA added three Linux kernel flaws to its Known Exploited Vulnerabilities catalog on September 18. Two of them, a race condition and an out-of-bounds write, went in together. The third, CVE-2025-39682, arrived in an alert of its own, and it is the more interesting of the set precisely because nothing about it looked like a bug worth an attacker's time.
That makes five Linux kernel vulnerabilities flagged as actively exploited since August 26, in a catalog that now runs to 1,716 entries.
The patch is a year old
The flaw sits in the kernel's TLS receive path. In CISA's own wording, a zero-length record retrieved from the rx_list can bypass the intended recvmsg() record-type handling, so subsequent TLS records may be processed using incorrect zero-copy and queuing assumptions. It was fixed upstream and published on September 5, 2025, with the repair landing across five commits in the stable tree. Debian shipped it through its long-term support channel the month after, and Siemens issued a product advisory of its own. The catalog entry adds that affected products may be end of life, in which case the guidance is to stop using them rather than to patch.
Nothing about the flaw is a fresh disclosure. What changed is that somebody started using it.
The scoring models did not see this coming
NVD's own analysts rated it 7.1, high, with a local attack vector, meaning an attacker needs a foothold on the machine before the bug is worth anything. A second scoring source in the same record puts it at 9.8, critical, and reachable across the network. That is an unusually wide gap for a single bug, and a defender triaging purely by severity would have treated it very differently depending on which line they happened to read.
EPSS, the model that estimates how likely a vulnerability is to be exploited, put it at 0.5 percent on September 18, the forty-second percentile. Prediction placed it in the unremarkable middle of the pack on the same day CISA said it was being exploited. CISA's own published decision record is blunter than either: exploitation "active", automatable "yes", technical impact "total".
Federal agencies have until September 21
That is a three-day clock, set under Binding Operational Directive 26-04, which tells agencies to prioritize publicly exposed assets where exploitation hands over total control of the asset. This entry also carries the directive's forensic triage flag, so agencies are expected to establish whether they were already compromised before the patch went on, rather than patching and moving on.
For everyone else the practical question is which kernel is actually running, which on a long-lived server is frequently not the kernel the package manager reports as installed. Long-term support distributions backport fixes into older version strings, so the number alone does not answer it, and the outstanding action is often a reboot rather than an update. Anyone who has been deferring kernel reboots over the downtime now has five reasons from the past month to book the window.
The addition is documented in CISA's alert, with the technical record at NVD. The shape of it is familiar from the batch CISA published in late August, where a 2023 ownCloud flaw was flagged alongside a kernel bug: what reaches this catalog is usually not new, only newly useful to somebody.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.