CVE-2025-37894
Description
A flaw was found in the Linux kernel. This vulnerability allows a denial of service (DoS) via incorrect socket (sock) handling in the networking (net) subsystem when the socket state (sk_state) is Transmission Control Protocol (TCP) TIME_WAIT, which can cause a crash due to a use-after-free.
Statement
A moderate use-after-free flaw was found in the Linux kernel networking subsystem, affecting the kernel component in Red Hat Enterprise Linux 10. The lookup functions __inet_lookup_established() and __inet6_lookup_established() can return a struct inet_timewait_sock pointer when a socket is in the TCP_TIME_WAIT state; calling sock_put() on such a pointer, as can occur in the IPv6 GRO receive path (tcp6_check_fraglist_gro()), causes incorrect memory access in sk_free() and can crash the kernel, resulting in a local denial of service. Red Hat assesses this flaw as moderate severity, CVSS 3.1 score 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), because exploitation requires local privileges and only availability is impacted; this differs significantly from the CVEORG score of 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), which assumes an unauthenticated remote attack vector with confidentiality and integrity impact that the flaw's technical evidence does not support. The vulnerable code is not present in Red Hat Enterprise Linux 6, 8, and 9 (including kernel-rt), in Red Hat In-Vehicle OS, or in the Hosted OpenShift (ARO/OSD) environments, so those products are not affected. Red Hat Enterprise Linux 7 kernel and kernel-rt are out of support scope (OOSS) and no fix is planned for them. For the affected Red Hat Enterprise Linux 10 streams, the fix is deferred, so the vulnerable code remains and the residual risk is a local denial of service through a kernel crash.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | 5.5 | 9.8 |
| Attack Vector | Local | Local | Network |
| Attack Complexity | Low | Low | Low |
| Privileges Required | Low | Low | None |
| User Interaction | None | None | None |
| Scope | Unchanged | Unchanged | Unchanged |
| Confidentiality | None | None | High |
| Integrity Impact | None | None | High |
| Availability Impact | High | High | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
NVD: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Understanding the Weakness (CWE)
Integrity,Availability,Confidentiality
Technical Impact: Modify Memory; DoS: Crash, Exit, or Restart; Execute Unauthorized Code or Commands
This weakness may result in the corruption of memory, and perhaps instructions, possibly leading to a crash. If the corrupted memory can be effectively controlled, it may be possible to execute arbitrary code.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
