CVE-2025-39682 — Linux Kernel Known Exploited Vulnerability

← Technology Risk Center   /   Linux

Status: Known exploited vulnerability

CVE-2025-39682 — Linux Kernel

CISA added CVE-2025-39682 to its Known Exploited Vulnerabilities catalog on September 18, 2026 based on evidence of active exploitation.

What the issue is

The vulnerability is described as a Linux Kernel improper check for unusual or exceptional conditions vulnerability.

Why a business should care

Known exploitation raises the priority above a vulnerability that is only theoretically exploitable. Businesses should first determine whether Linux systems in their environment use an affected kernel/version and whether those systems are exposed or support a critical business service.

What to check

• Whether Linux is present in servers, appliances, virtual machines or embedded business systems.
• The exact distribution and kernel version.
• Whether the applicable vendor or distribution has issued a supported update or mitigation.
• Whether the system is internet-facing or otherwise exposed to untrusted access.
• Whether compromise indicators should be reviewed before or after remediation.

Source record

Primary source: Cybersecurity and Infrastructure Security Agency (CISA), Known Exploited Vulnerabilities update.

CISA update date: September 18, 2026.

CompFlorida record reviewed: September 21, 2026.

Important: This record does not establish that a specific business system is vulnerable. Confirm product/version applicability and remediation guidance for the Linux distribution or product in use before changing production systems.