CVE-2025-39682 is a critical vulnerability in the Linux kernel's software TLS (kTLS) receive path, in net/tls/tls_sw.c. When an application configures a TCP socket with kernel TLS offload (TCP_ULP set to "tls"), the kernel decrypts incoming TLS records directly and delivers plaintext to the application, bypassing userspace libraries such as OpenSSL. This is widely used on high-throughput Linux servers, including content delivery networks, reverse proxies, and database servers.

The following Linux kernel versions are affected, where kernel TLS (CONFIG_TLS with the TLS ULP) is enabled and in use:

• Linux kernel 6.0 through 6.1.148
• Linux kernel 6.2 through 6.6.102
• Linux kernel 6.7 through 6.12.43
• Linux kernel 6.13 through 6.16.3

Systems that do not use kernel TLS (kTLS) are not exposed to this specific vulnerability, though CERTVU still recommends patching as a precaution.

Not affected / patched version:

• Linux kernel 6.1.149, 6.6.103, 6.12.44, 6.16.4, or 6.17 and later
• Distribution-specific patched kernel packages released by your Linux vendor

Successful exploitation may allow attackers to:

• Trigger a use-after-free condition in the kernel's TLS receive path, causing memory corruption or a system crash
• Potentially achieve local privilege escalation, including root-level access, as demonstrated by independent security researchers
• Reach the vulnerable code path remotely on any internet-facing service using kernel TLS (kTLS) offload

CERTVU recommends the following:

1. Apply the vendor patch immediately

   Upgrade to a kernel release that ships the fix (6.1.149, 6.6.103, 6.12.44, 6.16.4, or 6.17+), or install your distribution's latest kernel security update, then reboot into the patched kernel. There is no configuration fix that resolves the underlying code defect.

2. Audit and inventory kTLS usage

   Identify all servers using kernel TLS offload (CONFIG_TLS with TCP_ULP set to "tls") and treat them as top-priority remediation targets, particularly internet-facing services such as CDNs, reverse proxies, and database servers.

3. Disable kTLS as an interim workaround where not required

4. Treat this as the highest priority in this batch