CVE-2025-37756

Published May 1, 2025

Last updated a month ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-37756 describes a vulnerability within the Linux kernel's TLS (Transport Layer Security) subsystem. The issue, identified by syzbot, stemmed from the ability to disconnect a TLS socket, which could lead to various unexpected scenarios and trigger warnings within the kernel, specifically in `tls_strp.c`. To address this, the resolution involved explicitly disallowing the `disconnect` operation for TLS sockets, as properly supporting this functionality, particularly with offload enabled, was deemed complex due to the need to ensure all packets are acknowledged. Subsequently, a related vulnerability emerged that acts as a bypass for the CVE-2025-37756 patch. This bypass affects the Linux kernel's KTLS (Kernel TLS) subsystem when it interacts with BPF sockmap. The bypass can be triggered by draining the `skb` using BPF, mirroring the `tcp_disconnect` behavior associated with the original CVE-2025-37756. The underlying flaw in this bypass involves the kernel's handling of KTLS and BPF sockmaps, where the `tls_init` path fails to verify if a socket is already linked to a sockmap, potentially allowing exploitation by a malicious user.

Description: In the Linux kernel, the following vulnerability has been resolved: net: tls: explicitly disallow disconnect syzbot discovered that it can disconnect a TLS socket and then run into all sort of unexpected corner cases. I have a vague recollection of Eric pointing this out to us a long time ago. Supporting disconnect is really hard, for one thing if offload is enabled we'd need to wait for all packets to be _acked_. Disconnect is not commonly used, disallow it. The immediate problem syzbot run into is the warning in the strp, but that's just the easiest bug to trigger: WARNING: CPU: 0 PID: 5834 at net/tls/tls_strp.c:486 tls_strp_msg_load+0x72e/0xa80 net/tls/tls_strp.c:486 RIP: 0010:tls_strp_msg_load+0x72e/0xa80 net/tls/tls_strp.c:486 Call Trace: <TASK> tls_rx_rec_wait+0x280/0xa60 net/tls/tls_sw.c:1363 tls_sw_recvmsg+0x85c/0x1c30 net/tls/tls_sw.c:2043 inet6_recvmsg+0x2c9/0x730 net/ipv6/af_inet6.c:678 sock_recvmsg_nosec net/socket.c:1023 [inline] sock_recvmsg+0x109/0x280 net/socket.c:1045 __sys_recvfrom+0x202/0x380 net/socket.c:2237
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
NVD status: Modified
Products: linux_kernel, debian_linux

Risk scores

CVSS 3.1

Type: Primary
Base score: 5.5
Impact score: 3.6
Exploitability score: 1.8
Vector string: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Severity: MEDIUM

Weaknesses

nvd@nist.gov: NVD-CWE-noinfo

Hype score: Not currently trending

Linux kernel: KTLS + sockmap "Reverse Order" Use-After-Free / Data Corruption https://t.co/RH5EmLQrji "CVE-2025-37756 has been hacked on google KernelCTF. This is a bypass for the CVE-2025-37756 patch, also can used for LPE with the same flow of CVE-2025-37756."
@oss_security
7 May 2026
1969 Impressions
1 Retweet
21 Likes
6 Bookmarks
0 Replies
0 Quotes

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "E5E88B86-BD7B-40BA-94BA-8AA10CEE8C06",
            "versionEndExcluding": "5.10.237",
            "versionStartIncluding": "4.13",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "12331C9E-F601-4EFC-899E-369F98DCC70B",
            "versionEndExcluding": "5.15.181",
            "versionStartIncluding": "5.11",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "5B9ACE29-7445-4B6F-B761-6367C005E275",
            "versionEndExcluding": "6.1.135",
            "versionStartIncluding": "5.16",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "6E5947E5-45E3-462A-829B-382B3B1C61BD",
            "versionEndExcluding": "6.6.88",
            "versionStartIncluding": "6.2",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "1D35A8A8-F3EC-45E6-AD37-1F154B27529D",
            "versionEndExcluding": "6.12.24",
            "versionStartIncluding": "6.7",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "4A475784-BF3B-4514-81EE-49C8522FB24A",
            "versionEndExcluding": "6.13.12",
            "versionStartIncluding": "6.13",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "483E2E15-2135-4EC6-AB64-16282C5EF704",
            "versionEndExcluding": "6.14.3",
            "versionStartIncluding": "6.14",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc1:*:*:*:*:*:*",
            "matchCriteriaId": "8D465631-2980-487A-8E65-40AE2B9F8ED1",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  },
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*",
            "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.