# Linux kernel improper condition check under active exploit

Published: 2026-09-18 · Severity: severe · Sectors: government-national, defense
Canonical: https://vorant.io/reports/f8461842-6814-526d-b297-6bb9fc6ab6cb/linux-kernel-improper-condition-check-under-active-exploit

> CVE-2025-39682 in Linux kernel is actively exploited; patch immediately on exposed systems.

CISA has added CVE-2025-39682 to its Known Exploited Vulnerabilities (KEV) Catalog, confirming active exploitation in the wild. This is an improper check for unusual or exceptional conditions vulnerability in the Linux kernel. The flaw poses significant risk because successful exploitation grants total control of the affected asset post-compromise. Federal agencies are required under Binding Operational Directive (BOD) 26-04 to prioritize rapid remediation of this vulnerability on publicly exposed systems and to assess whether systems were compromised before patching. While BOD 26-04 applies specifically to Federal Civilian Executive Branch agencies, CISA recommends all organizations adopt risk-based vulnerability management and prioritize patching this CVE.

## Mentioned in this report

- Vulnerabilities: CVE-2025-39682 (KEV)

Source reporting: https://www.cisa.gov/news-events/alerts/2026/09/18/cisa-adds-one-known-exploited-vulnerability-catalog

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/f8461842-6814-526d-b297-6bb9fc6ab6cb/linux-kernel-improper-condition-check-under-active-exploit.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup