CVE-2025-37756: net: tls: explicitly disallow disconnect
In the Linux kernel, the following vulnerability has been resolved:
net: tls: explicitly disallow disconnect
syzbot discovered that it can disconnect a TLS socket and then run into all sort of unexpected corner cases. I have a vague recollection of Eric pointing this out to us a long time ago. Supporting disconnect is really hard, for one thing if offload is enabled we'd need to wait for all packets to be acked. Disconnect is not commonly used, disallow it.
The immediate problem syzbot run into is the warning in the strp, but that's just the easiest bug to trigger:
WARNING: CPU: 0 PID: 5834 at net/tls/tlsstrp.c:486 tlsstrpmsgload+0x72e/0xa80 net/tls/tlsstrp.c:486 RIP: 0010:tlsstrpmsgload+0x72e/0xa80 net/tls/tlsstrp.c:486 Call Trace: <TASK> tlsrxrecwait+0x280/0xa60 net/tls/tlssw.c:1363 tlsswrecvmsg+0x85c/0x1c30 net/tls/tlssw.c:2043 inet6recvmsg+0x2c9/0x730 net/ipv6/afinet6.c:678 sockrecvmsgnosec net/socket.c:1023 [inline] sockrecvmsg+0x109/0x280 net/socket.c:1045 sysrecvfrom+0x202/0x380 net/socket.c:2237
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-37756?
CVE-2025-37756 has been classified as a high-severity vulnerability affecting the Linux kernel.
How do I fix CVE-2025-37756?
To fix CVE-2025-37756, update your Linux kernel to the latest stable version that includes the security patch.
What systems are affected by CVE-2025-37756?
CVE-2025-37756 affects various distributions that use the Linux kernel, particularly those utilizing TLS sockets.
What kind of impact does CVE-2025-37756 have?
CVE-2025-37756 can lead to unexpected behaviors in TLS socket disconnections, potentially exposing systems to further vulnerabilities.
Who discovered CVE-2025-37756?
CVE-2025-37756 was discovered by the syzbot automated testing framework.