CVE-2025-37814

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

tty: Require CAP_SYS_ADMIN for all usages of TIOCL_SELMOUSEREPORT

This requirement was overeagerly loosened in commit 2f83e38a095f

("tty: Permit some TIOCL_SETSEL modes without CAP_SYS_ADMIN"), but as

it turns out,

(1) the logic I implemented there was inconsistent (apologies!),

(2) TIOCL_SELMOUSEREPORT might actually be a small security risk

after all, and

(3) TIOCL_SELMOUSEREPORT is only meant to be used by the mouse

daemon (GPM or Consolation), which runs as CAP_SYS_ADMIN

already.

In more detail:

1. The previous patch has inconsistent logic:

In commit 2f83e38a095f ("tty: Permit some TIOCL_SETSEL modes

without CAP_SYS_ADMIN"), we checked for sel_mode ==

TIOCL_SELMOUSEREPORT, but overlooked that the lower four bits of

this "mode" parameter were actually used as an additional way to

pass an argument. So the patch did actually still require

CAP_SYS_ADMIN, if any of the

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References