The Cybersecurity and Infrastructure Security Agency has expanded its Known Exploited Vulnerabilities (KEV) catalog with three Linux kernel flaws, urging federal agencies to immediately patch them.
Tracked as CVE-2025-39682 (CVSS score of 9.8), the first of the bugs is a critical-severity issue impacting the kernel’s handling of zero-length records on the rx_list in the TLS receive path.
This is a corner case where the recvmsg() logic – each recvmsg() call processes either DATA or non-DATA records – breaks out of the processing loop when an initial zero-length record is pulled from rx_list.
When zero-copy decryption occurs, the kernel decrypts ciphertext into a user-space buffer. Because zero-copy is permitted only with DATA records, the vulnerable function assumes that no type change can occur after the zero-copy, but the logic can be broken using a zero-length record originating from rx_list.
A local attacker could exploit this improper check for unusual or exceptional conditions to cause a denial-of-service (DoS) condition or trigger memory disclosure.
The second vulnerability, CVE-2025-39964 (CVSS score of 7.8), is described as a race condition: issuing two writes to the same AF_ALG socket leads to data being interleaved in an unpredictable fashion.
An attacker could trigger the security defect to create inconsistencies in the socket’s internal state, leading to system crashes or corrupted cryptographic operation results, which could cause DoS conditions.