VYPR
← All advisories
Medium severity5.5NVD Advisory· Published May 1, 2025· Updated May 7, 2026

CVE-2025-37756

CVE-2025-37756

Description

In the Linux kernel, the following vulnerability has been resolved:

net: tls: explicitly disallow disconnect

syzbot discovered that it can disconnect a TLS socket and then run into all sort of unexpected corner cases. I have a vague recollection of Eric pointing this out to us a long time ago. Supporting disconnect is really hard, for one thing if offload is enabled we'd need to wait for all packets to be _acked_. Disconnect is not commonly used, disallow it.

The immediate problem syzbot run into is the warning in the strp, but that's just the easiest bug to trigger:

WARNING: CPU: 0 PID: 5834 at net/tls/tls_strp.c:486 tls_strp_msg_load+0x72e/0xa80 net/tls/tls_strp.c:486 RIP: 0010:tls_strp_msg_load+0x72e/0xa80 net/tls/tls_strp.c:486 Call Trace:

tls_rx_rec_wait+0x280/0xa60 net/tls/tls_sw.c:1363 tls_sw_recvmsg+0x85c/0x1c30 net/tls/tls_sw.c:2043 inet6_recvmsg+0x2c9/0x730 net/ipv6/af_inet6.c:678 sock_recvmsg_nosec net/socket.c:1023 [inline] sock_recvmsg+0x109/0x280 net/socket.c:1045 __sys_recvfrom+0x202/0x380 net/socket.c:2237

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

A flaw in the Linux kernel's TLS implementation allows privilege escalation via a use-after-free triggered by disconnecting a TLS socket.

Vulnerability

Overview

CVE-2025-37756 is a use-after-free vulnerability in the Linux kernel's TLS subsystem. The root cause is that the TLS socket code did not explicitly disallow the disconnect operation. When a TLS socket is disconnected, the internal state (including the strparser state) becomes inconsistent, leading to potential exploitation. The issue was discovered by syzbot, which triggered a warning in tls_strp_msg_load, but the underlying problem is more severe and can be exploited beyond a denial of service.[1]

Attack

Vector

The attack is initiated by a local attacker with the ability to create and disconnect a TLS socket. No special privileges are needed to perform the socket operations. The disconnect triggers a chain of events that corrupts kernel memory, leading to a use-after-free condition. The exploitability is increased by the fact that the TLS offload path complicates the handling of outstanding packets, making the disconnect operation unsafe.[1][2]

Impact

Successful exploitation of this vulnerability could allow an attacker to escalate privileges on the affected system. The issue goes beyond a simple system crash; the original reporter confirmed that the vulnerability is exploitable for privilege escalation, not just denial of service.[1] The impact is localized to the kernel, but it can compromise the entire system's security if exploited.

Mitigation

The Linux kernel developers have addressed the issue by explicitly disallowing the disconnect operation on TLS sockets. The fix was applied to multiple stable kernel branches, ensuring widespread coverage.[2][3][4] Users are advised to apply the latest kernel patches to protect against this vulnerability.

References
  1. oss-security - Linux kernel: KTLS + sockmap "Reverse Order" Use-After-Free
  2. Making sure you're not a bot!
  3. Making sure you're not a bot!
  4. Making sure you're not a bot!

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

91

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

11

News mentions

0

No linked articles in our index yet.