CVE-2025-37894: net: use sock_gen_put() when sk_state is TCP_TIME_WAIT
In the Linux kernel, the following vulnerability has been resolved:
net: use sockgenput() when skstate is TCPTIMEWAIT
It is possible for a pointer of type struct inettimewaitsock to be returned from the functions inetlookupestablished() and inet6lookupestablished(). This can cause a crash when the returned pointer is of type struct inettimewaitsock and sockput() is called on it. The following is a crash call stack that shows sk->skwmemalloc being accessed in skfree() during the call to sockput() on a struct inettimewaitsock pointer. To avoid this issue, use sockgenput() instead of sockput() when sk->skstate is TCPTIMEWAIT.
mrdump.ko ipanic() + 120 vmlinux notifiercallchain(nrtocall=-1, nrcalls=0) + 132 vmlinux atomicnotifiercallchain(val=0) + 56 vmlinux panic() + 344 vmlinux addtaint() + 164 vmlinux endreport() + 136 vmlinux kasanreport(size=0) + 236 vmlinux reporttagfault() + 16 vmlinux dotagrecovery() + 16 vmlinux dokernelfault() + 88 vmlinux dobadarea() + 28 vmlinux dotagcheckfault() + 60 vmlinux domemabort() + 80 vmlinux el1abort() + 56 vmlinux el1h64synchandler() + 124 vmlinux > 0xFFFFFFC080011294() vmlinux lseatomicfetchaddrelease(v=0xF2FFFF82A896087C) vmlinux lseatomicfetchsubrelease(v=0xF2FFFF82A896087C) vmlinux archatomicfetchsubrelease(i=1, v=0xF2FFFF82A896087C) + 8 vmlinux rawatomicfetchsubrelease(i=1, v=0xF2FFFF82A896087C) + 8 vmlinux atomicfetchsubrelease(i=1, v=0xF2FFFF82A896087C) + 8 vmlinux refcountsubandtest(i=1, r=0xF2FFFF82A896087C, oldp=0) + 8 vmlinux refcountdecandtest(r=0xF2FFFF82A896087C, oldp=0) + 8 vmlinux refcountdecandtest(r=0xF2FFFF82A896087C) + 8 vmlinux skfree(sk=0xF2FFFF82A8960700) + 28 vmlinux sockput() + 48 vmlinux tcp6checkfraglistgro() + 236 vmlinux tcp6groreceive() + 624 vmlinux ipv6groreceive() + 912 vmlinux devgroreceive() + 1116 vmlinux napigroreceive() + 196 ccmni.ko ccmnirxcallback() + 208 ccmni.ko ccmniqueuerecvskb() + 388 cccidpmaif.ko dpmaifrxqpushthread() + 1088 vmlinux kthread() + 268 vmlinux 0xFFFFFFC08001F30C()
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Update the Linux kernel network code path to avoid calling sock_put() on a struct inet_timewait_sock pointer. Specifically, use sock_gen_put() instead of sock_put() when sk->sk_state is TCP_TIME_WAIT (the bug occurs when sock_put() ends up calling sk_free() and accessing sk->sk_wmem_alloc for struct inet_timewait_sock).
Linux kernel sock_put() usage for inet_timewait_sock = use sock_gen_put() instead of sock_put() when sk->sk_state is TCP_TIME_WAIT
Event History
Frequently Asked Questions
What is the severity of CVE-2025-37894?
CVE-2025-37894 has been rated as a moderate severity vulnerability in the Linux kernel.
How do I fix CVE-2025-37894?
To resolve CVE-2025-37894, update your Linux kernel to the latest version provided by your distribution.
What does CVE-2025-37894 affect?
CVE-2025-37894 affects the networking portion of the Linux kernel related to the TCP_TIME_WAIT state.
Is CVE-2025-37894 exploitable?
Yes, CVE-2025-37894 could potentially allow an attacker to exploit the vulnerability under specific conditions.
Where can I find more information about CVE-2025-37894?
Details regarding CVE-2025-37894 can be found in the Linux kernel changelogs and security reports.