CVE-2025-37894

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: use sock_gen_put() when sk_state is TCP_TIME_WAIT

It is possible for a pointer of type struct inet_timewait_sock to be

returned from the functions __inet_lookup_established() and

__inet6_lookup_established(). This can cause a crash when the

returned pointer is of type struct inet_timewait_sock and

sock_put() is called on it. The following is a crash call stack that

shows sk->sk_wmem_alloc being accessed in sk_free() during the call to

sock_put() on a struct inet_timewait_sock pointer. To avoid this issue,

use sock_gen_put() instead of sock_put() when sk->sk_state

is TCP_TIME_WAIT.

mrdump.ko ipanic() + 120

vmlinux notifier_call_chain(nr_to_call=-1, nr_calls=0) + 132

vmlinux atomic_notifier_call_chain(val=0) + 56

vmlinux panic() + 344

vmlinux add_taint() + 164

vmlinux end_report() + 136

vmlinux kasan_report(size=0) + 236

vmlinux report_tag_faul

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References