CVE-2025-37894

A flaw was found in the Linux kernel. This vulnerability allows a denial of service (DoS) via incorrect socket (sock) handling in the networking (net) subsystem when the socket state (sk_state) is Transmission Control Protocol (TCP) TIME_WAIT, which can cause a crash due to a use-after-free.

A moderate use-after-free flaw was found in the Linux kernel networking subsystem, affecting the kernel component in Red Hat Enterprise Linux 10. The lookup functions __inet_lookup_established() and __inet6_lookup_established() can return a struct inet_timewait_sock pointer when a socket is in the TCP_TIME_WAIT state; calling sock_put() on such a pointer, as can occur in the IPv6 GRO receive path (tcp6_check_fraglist_gro()), causes incorrect memory access in sk_free() and can crash the kernel, resulting in a local denial of service. Red Hat assesses this flaw as moderate severity, CVSS 3.1 score 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), because exploitation requires local privileges and only availability is impacted; this differs significantly from the CVEORG score of 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), which assumes an unauthenticated remote attack vector with confidentiality and integrity impact that the flaw's technical evidence does not support. The vulnerable code is not present in Red Hat Enterprise Linux 6, 8, and 9 (including kernel-rt), in Red Hat In-Vehicle OS, or in the Hosted OpenShift (ARO/OSD) environments, so those products are not affected. Red Hat Enterprise Linux 7 kernel and kernel-rt are out of support scope (OOSS) and no fix is planned for them. For the affected Red Hat Enterprise Linux 10 streams, the fix is deferred, so the vulnerable code remains and the residual risk is a local denial of service through a kernel crash.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.