CVE-2025-37894— net: use sock_gen_put() when sk_state is TCP_TIME_WAIT
Quick assessment
Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于TCP_TIME_WAIT状态下的套接字释放不当，可能导致崩溃。
Possible ATT&CK Techniques 1 AI
T1499 · Endpoint Denial of ServiceAffected Version Matrix 8
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Linux | Linux | c9d1d23e5239f41700be69133a5769ac5ebc88a8< c0dba059b118b5206e755042b15b49368a388898 |
affected |
c9d1d23e5239f41700be69133a5769ac5ebc88a8< 786650e644c5b1c063921799ca203c0b8670d79a |
affected | ||
c9d1d23e5239f41700be69133a5769ac5ebc88a8< f920436a44295ca791ebb6dae3f4190142eec703 |
affected | ||
6.10 |
affected | ||
< 6.10 |
unaffected | ||
6.12.28≤ 6.12.* |
unaffected | ||
6.14.6≤ 6.14.* |
unaffected | ||
6.15≤ * |
unaffected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-37894
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
net: use sock_gen_put() when sk_state is TCP_TIME_WAIT
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved:
net: use sock_gen_put() when sk_state is TCP_TIME_WAIT
It is possible for a pointer of type struct inet_timewait_sock to be
returned from the functions __inet_lookup_established() and
__inet6_lookup_established(). This can cause a crash when the
returned pointer is of type struct inet_timewait_sock and
sock_put() is called on it. The following is a crash call stack that
shows sk->sk_wmem_alloc being accessed in sk_free() during the call to
sock_put() on a struct inet_timewait_sock pointer. To avoid this issue,
use sock_gen_put() instead of sock_put() when sk->sk_state
is TCP_TIME_WAIT.
mrdump.ko ipanic() + 120
vmlinux notifier_call_chain(nr_to_call=-1, nr_calls=0) + 132
vmlinux atomic_notifier_call_chain(val=0) + 56
vmlinux panic() + 344
vmlinux add_taint() + 164
vmlinux end_report() + 136
vmlinux kasan_report(size=0) + 236
vmlinux report_tag_fault() + 16
vmlinux do_tag_recovery() + 16
vmlinux __do_kernel_fault() + 88
vmlinux do_bad_area() + 28
vmlinux do_tag_check_fault() + 60
vmlinux do_mem_abort() + 80
vmlinux el1_abort() + 56
vmlinux el1h_64_sync_handler() + 124
vmlinux > 0xFFFFFFC080011294()
vmlinux __lse_atomic_fetch_add_release(v=0xF2FFFF82A896087C)
vmlinux __lse_atomic_fetch_sub_release(v=0xF2FFFF82A896087C)
vmlinux arch_atomic_fetch_sub_release(i=1, v=0xF2FFFF82A896087C)
+ 8
vmlinux raw_atomic_fetch_sub_release(i=1, v=0xF2FFFF82A896087C)
+ 8
vmlinux atomic_fetch_sub_release(i=1, v=0xF2FFFF82A896087C) + 8
vmlinux __refcount_sub_and_test(i=1, r=0xF2FFFF82A896087C,
oldp=0) + 8
vmlinux __refcount_dec_and_test(r=0xF2FFFF82A896087C, oldp=0) + 8
vmlinux refcount_dec_and_test(r=0xF2FFFF82A896087C) + 8
vmlinux sk_free(sk=0xF2FFFF82A8960700) + 28
vmlinux sock_put() + 48
vmlinux tcp6_check_fraglist_gro() + 236
vmlinux tcp6_gro_receive() + 624
vmlinux ipv6_gro_receive() + 912
vmlinux dev_gro_receive() + 1116
vmlinux napi_gro_receive() + 196
ccmni.ko ccmni_rx_callback() + 208
ccmni.ko ccmni_queue_recv_skb() + 388
ccci_dpmaif.ko dpmaif_rxq_push_thread() + 1088
vmlinux kthread() + 268
vmlinux 0xFFFFFFC08001F30C()
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于TCP_TIME_WAIT状态下的套接字释放不当，可能导致崩溃。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2025-37894
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-37894
请登录查看更多情报信息。
Same Patch Batch · Linux · 2025-05-20 · 95 CVEs total
| CVE-2025-37924 | 9.8 CRITICAL | ksmbd: fix use-after-free in kerberos authentication |
| CVE-2025-37935 | 9.8 CRITICAL | net: ethernet: mtk_eth_soc: fix SER panic with 4GB+ RAM |
| CVE-2025-37959 | 9.4 CRITICAL | bpf: Scrub packet on bpf_redirect_peer |
| CVE-2025-37956 | 8.8 HIGH | ksmbd: prevent rename with empty string |
| CVE-2025-37899 | 8.8 HIGH | ksmbd: fix use-after-free in session logoff |
| CVE-2025-37918 | 8.8 HIGH | Bluetooth: btusb: avoid NULL pointer dereference in skb_dequeue() |
| CVE-2025-37926 | 8.8 HIGH | ksmbd: fix use-after-free in ksmbd_session_rpc_open |
| CVE-2025-37943 | 8.8 HIGH | wifi: ath12k: Fix invalid data access in ath12k_dp_rx_h_undecap_nwifi |
| CVE-2025-37944 | 8.8 HIGH | wifi: ath12k: Fix invalid entry fetch in ath12k_dp_mon_srng_process |
| CVE-2025-37947 | 8.8 HIGH | ksmbd: prevent out-of-bounds stream writes by validating *pos |
| CVE-2025-37952 | 8.8 HIGH | ksmbd: Fix UAF in __close_file_table_ids |
| CVE-2025-37957 | 8.8 HIGH | KVM: SVM: Forcibly leave SMM mode on SHUTDOWN interception |
| CVE-2025-37936 | 8.7 HIGH | perf/x86/intel: KVM: Mask PEBS_ENABLE loaded for guest with vCPU's value. |
| CVE-2025-37973 | 8.1 HIGH | wifi: cfg80211: fix out-of-bounds access during multi-link element defragmentation |
| CVE-2025-37903 | 7.8 HIGH | drm/amd/display: Fix slab-use-after-free in hdcp |
| CVE-2025-37920 | 7.8 HIGH | xsk: Fix race condition in AF_XDP generic RX path |
| CVE-2025-37921 | 7.8 HIGH | vxlan: vnifilter: Fix unlocked deletion of default FDB entry |
| CVE-2025-37977 | 7.8 HIGH | scsi: ufs: exynos: Disable iocc if dma-coherent property isn't set |
| CVE-2025-37923 | 7.8 HIGH | tracing: Fix oob write in trace_seq_to_buffer() |
| CVE-2025-37906 | 7.8 HIGH | ublk: fix race between io_uring_cmd_complete_in_task and ublk_cancel_cmd |
Showing top 20 of 95 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
-
CVE-2026-99999
ipv4: validate checksum_start before completing checksum -
CVE-2026-98432
ipv4: free inet_opt and ireq_opt after an RCU grace period -
CVE-2026-98431
RDMA/uverbs: Fix mmap_lock/disassociation_lock circular depe -
CVE-2026-98430
RDMA/efa: Keep admin queues alive while IRQ is registered -
CVE-2026-98429
RDMA/efa: Keep EQ resources alive while IRQ is registered
Same vendor: Linux
-
CVE-2026-99999
ipv4: validate checksum_start before completing checksum -
CVE-2026-98432
ipv4: free inet_opt and ireq_opt after an RCU grace period -
CVE-2026-98431
RDMA/uverbs: Fix mmap_lock/disassociation_lock circular depe -
CVE-2026-98430
RDMA/efa: Keep admin queues alive while IRQ is registered -
CVE-2026-98429
RDMA/efa: Keep EQ resources alive while IRQ is registered
V. Comments for CVE-2025-37894
No comments yet