CVE-2025-39682 — Linux kTLS zero-length rx_list record UAF tracking site

Source for the CVE-2025-39682 patch-status tracker: a single-page site recording which distributions have shipped a fix for a use-after-free in the Linux kernel's kTLS receive path (net/tls).

Where the facts live

Everything about the bug — CVE IDs, affected and fixed versions, upstream fix commits, discovery and disclosure credit, and current per-distribution patch status — belongs to the tracker page, not to this README:

• Rendered: https://kimmo.cloud/CVE-2025-39682/
• Source: site/content/_index.md

Edit that file; everything else in this repo is build infrastructure.

None of it is restated here on purpose. The tracker page is revised as CVEs are assigned and distributions ship fixes — twice daily by the auto-update agent while the tracker is live — so any copy kept in this README would silently rot. Resist re-adding a summary.

Deployment plan and current setup state live in WEBSITE.md.

Local development

Requires Hugo extended (≥ 0.146.0) and Go (for Hugo Modules to fetch the PaperMod theme).

nix develop          # dev shell: hugo, go, git, resvg
cd site
hugo server          # local preview at http://localhost:1313/CVE-2025-39682/

If you use direnv, direnv allow once and the dev shell auto-activates whenever you cd into the repo.

Build and publish

make build       # local build into site/public/
make dist        # build, then rsync to haig:/CVE-2025-39682/
make banner      # re-rasterise the social banner SVG → PNG (needs resvg + Roboto)

make dist runs make build first. make banner is only needed after editing site/assets/cve-2025-39682-tracker.svg; the rendered PNG is committed.

License

CC BY 4.0 — share and adapt with attribution.