Answer in brief
CVE-2025-37756 records a High severity (CVSS 7.8) vulnerability in net: tls: explicitly disallow disconnect. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Product | Affected versions | Fixed versions |
|---|---|---|
| cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:6.15:rc1:*:*:*:*:*:* | Not reported | Not reported |
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | 4.13 | Not reported |
| Linux/Linuxgeneric | >=3c4d7559159bfe1e3b94df3a657b2cda3a34e218 <7bdcf5bc35ae59fc4a0fa23276e84b4d1534a3cf || >=3c4d7559159bfe1e3b94df3a657b2cda3a34e218 <ac91c6125468be720eafde9c973994cb45b61d44 || >=3c4d7559159bfe1e3b94df3a657b2cda3a34e218 <f3ce4d3f874ab7919edca364c147ac735f9f1d04 || >=3c4d7559159bfe1e3b94df3a657b2cda3a34e218 <2bcad8fefcecdd5f005d8c550b25d703c063c34a || >=3c4d7559159bfe1e3b94df3a657b2cda3a34e218 <9fcbca0f801580cbb583e9cb274e2c7fbe766ca6 || >=3c4d7559159bfe1e3b94df3a657b2cda3a34e218 <c665bef891e8972e1d3ce5bbc0d42a373346a2c3 || >=3c4d7559159bfe1e3b94df3a657b2cda3a34e218 <8513411ec321942bd3cfed53d5bb700665c67d86 || >=3c4d7559159bfe1e3b94df3a657b2cda3a34e218 <5071a1e606b30c0c11278d3c6620cd6a24724cf6 | 7bdcf5bc35ae59fc4a0fa23276e84b4d1534a3cf, ac91c6125468be720eafde9c973994cb45b61d44, f3ce4d3f874ab7919edca364c147ac735f9f1d04, 2bcad8fefcecdd5f005d8c550b25d703c063c34a, 9fcbca0f801580cbb583e9cb274e2c7fbe766ca6, c665bef891e8972e1d3ce5bbc0d42a373346a2c3, 8513411ec321942bd3cfed53d5bb700665c67d86, 5071a1e606b30c0c11278d3c6620cd6a24724cf6 |
Published upstream
May 1, 2025
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 5, 2026
In the Linux kernel, the following vulnerability has been resolved: net: tls: explicitly disallow disconnect syzbot discovered that it can disconnect a TLS socket and then run into all sort of unexpected corner cases. I have a vague recollection of Eric pointing this out to us a long time ago. Supporting disconnect is really hard, for one thing if offload is enabled we'd need to wait for all packets to be _acked_. Disconnect is not commonly used, disallow it. The immediate problem syzbot run into is the warning in the strp, but that's just the easiest bug to trigger: WARNING: CPU: 0 PID: 5834 at net/tls/tls_strp.c:486 tls_strp_msg_load+0x72e/0xa80 net/tls/tls_strp.c:486 RIP: 0010:tls_strp_msg_load+0x72e/0xa80 net/tls/tls_strp.c:486 Call Trace: <TASK> tls_rx_rec_wait+0x280/0xa60 net/tls/tls_sw.c:1363 tls_sw_recvmsg+0x85c/0x1c30 net/tls/tls_sw.c:2043 inet6_recvmsg+0x2c9/0x730 net/ipv6/af_inet6.c:678 sock_recvmsg_nosec net/socket.c:1023 [inline] sock_recvmsg+0x109/0x280 net/socket.c:1045 __sys_recvfrom+0x202/0x380 net/socket.c:2237
Quoted source text, attributed separately from HOL analysis.