CVE-2025-37756

In the Linux kernel, the following vulnerability has been resolved:

net: tls: explicitly disallow disconnect

syzbot discovered that it can disconnect a TLS socket and then run into all sort of unexpected corner cases. I have a vague recollection of Eric pointing this out to us a long time ago. Supporting disconnect is really hard, for one thing if offload is enabled we'd need to wait for all packets to be acked. Disconnect is not commonly used, disallow it.

The immediate problem syzbot run into is the warning in the strp, but that's just the easiest bug to trigger:

WARNING: CPU: 0 PID: 5834 at net/tls/tls_strp.c:486 tls_strp_msg_load+0x72e/0xa80 net/tls/tls_strp.c:486 RIP: 0010:tls_strp_msg_load+0x72e/0xa80 net/tls/tls_strp.c:486 Call Trace: <TASK> tls_rx_rec_wait+0x280/0xa60 net/tls/tls_sw.c:1363 tls_sw_recvmsg+0x85c/0x1c30 net/tls/tls_sw.c:2043 inet6_recvmsg+0x2c9/0x730 net/ipv6/af_inet6.c:678 sock_recvmsg_nosec net/socket.c:1023 [inline] sock_recvmsg+0x109/0x280 net/socket.c:1045 __sys_recvfrom+0x202/0x380 net/socket.c:2237

A low severity flaw was found in the Linux kernel's kernel TLS (kTLS) implementation, affecting Red Hat Enterprise Linux 9 and 10 (kernel and kernel-rt) and Red Hat In-Vehicle OS 1. The kTLS receive path did not explicitly disallow disconnecting a TLS socket, so a local user with access to a kTLS socket could issue a disconnect and then drive the socket into unexpected corner cases; the easiest problem to trigger is a kernel WARNING in the TLS strparser receive path (tls_strp_msg_load). Red Hat assesses the impact of this flaw as Low severity because exploitation requires local access with local privileges and the demonstrated consequence is limited to availability impact through a kernel warning in a rarely used code path. This is lower than the upstream CVEORG score of 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), which assumes high confidentiality, integrity, and availability impact that the demonstrated issue does not establish; NIST scores it 5.5 (moderate). Red Hat Enterprise Linux 6 and 7 long-life streams are not affected because the vulnerable code is not present, and the RHEL 8 z-streams are out of support scope. The upstream fix explicitly disallows disconnect on kTLS sockets; this fix is currently deferred for the affected streams, and the residual risk is that a local user could trigger a kernel warning or other unexpected behavior in the kTLS receive path.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.