CVE-2025-37894

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net: use sock_gen_put() when sk_state is TCP_TIME_WAIT<br /> <br /> It is possible for a pointer of type struct inet_timewait_sock to be<br /> returned from the functions __inet_lookup_established() and<br /> __inet6_lookup_established(). This can cause a crash when the<br /> returned pointer is of type struct inet_timewait_sock and<br /> sock_put() is called on it. The following is a crash call stack that<br /> shows sk-&gt;sk_wmem_alloc being accessed in sk_free() during the call to<br /> sock_put() on a struct inet_timewait_sock pointer. To avoid this issue,<br /> use sock_gen_put() instead of sock_put() when sk-&gt;sk_state<br /> is TCP_TIME_WAIT.<br /> <br /> mrdump.ko ipanic() + 120<br /> vmlinux notifier_call_chain(nr_to_call=-1, nr_calls=0) + 132<br /> vmlinux atomic_notifier_call_chain(val=0) + 56<br /> vmlinux panic() + 344<br /> vmlinux add_taint() + 164<br /> vmlinux end_report() + 136<br /> vmlinux kasan_report(size=0) + 236<br /> vmlinux report_tag_fault() + 16<br /> vmlinux do_tag_recovery() + 16<br /> vmlinux __do_kernel_fault() + 88<br /> vmlinux do_bad_area() + 28<br /> vmlinux do_tag_check_fault() + 60<br /> vmlinux do_mem_abort() + 80<br /> vmlinux el1_abort() + 56<br /> vmlinux el1h_64_sync_handler() + 124<br /> vmlinux &gt; 0xFFFFFFC080011294()<br /> vmlinux __lse_atomic_fetch_add_release(v=0xF2FFFF82A896087C)<br /> vmlinux __lse_atomic_fetch_sub_release(v=0xF2FFFF82A896087C)<br /> vmlinux arch_atomic_fetch_sub_release(i=1, v=0xF2FFFF82A896087C)<br /> + 8<br /> vmlinux raw_atomic_fetch_sub_release(i=1, v=0xF2FFFF82A896087C)<br /> + 8<br /> vmlinux atomic_fetch_sub_release(i=1, v=0xF2FFFF82A896087C) + 8<br /> vmlinux __refcount_sub_and_test(i=1, r=0xF2FFFF82A896087C,<br /> oldp=0) + 8<br /> vmlinux __refcount_dec_and_test(r=0xF2FFFF82A896087C, oldp=0) + 8<br /> vmlinux refcount_dec_and_test(r=0xF2FFFF82A896087C) + 8<br /> vmlinux sk_free(sk=0xF2FFFF82A8960700) + 28<br /> vmlinux sock_put() + 48<br /> vmlinux tcp6_check_fraglist_gro() + 236<br /> vmlinux tcp6_gro_receive() + 624<br /> vmlinux ipv6_gro_receive() + 912<br /> vmlinux dev_gro_receive() + 1116<br /> vmlinux napi_gro_receive() + 196<br /> ccmni.ko ccmni_rx_callback() + 208<br /> ccmni.ko ccmni_queue_recv_skb() + 388<br /> ccci_dpmaif.ko dpmaif_rxq_push_thread() + 1088<br /> vmlinux kthread() + 268<br /> vmlinux 0xFFFFFFC08001F30C()