Security readout for executives and security teams
Plain-English summary
A locally authenticated user may abuse an unsupported disconnect operation on a Linux kernel TLS socket, sending the kernel into unexpected states. The reported symptom is a kernel warning, but the maintainer indicates other corner cases exist. The supplied CVSS 3.1 score is 7.8, reflecting potentially serious confidentiality, integrity, and availability impact.
Executive priority
Prioritize internet-facing multi-user hosts, container platforms, and systems where untrusted local workloads can access kernel networking features. Treat remediation as high priority, but not as an emergency driven by known exploitation. Use normal expedited kernel patching and reboot procedures.
Technical view
The Linux kernel's TLS implementation permitted socket disconnect despite incomplete handling across TLS parsing, receive, and offload states. syzbot triggered a warning in tls_strp_msg_load after disconnecting a TLS socket. Stable fixes explicitly reject disconnect instead of attempting to preserve unsafe or inconsistent TLS state.
Likely exposure
Exposure requires an affected Linux kernel, local low-privilege access, and the ability to exercise kernel TLS sockets. The bundle lists affected releases beginning with 4.13 and multiple fixed stable releases, but its version encoding is ambiguous. Confirm exposure against the running distribution's advisory and kernel package changelog.
Exploitation context
The source bundle identifies a syzbot-generated trigger and marks this CVE as absent from KEV. It provides no evidence of active exploitation or public weaponization. The CVSS vector describes local, low-complexity, low-privilege exploitation without user interaction; network-only attackers are not established as an exposure path.
Researcher notes
The observed warning in tls_strp_msg_load is described as the easiest symptom, not necessarily the complete impact. Disconnect becomes especially difficult with TLS offload because outstanding packets may require acknowledgement. No CWE is assigned in the bundle. Validate affected ranges through vendor backport records rather than version-string comparison alone.
Mitigation direction
- Install the distribution kernel update incorporating the applicable upstream stable fix.
- Check vendor advisories because backported package versions may not match upstream release numbers.
- Restrict unnecessary local access and kernel TLS use until affected systems are updated.
- Reboot into the updated kernel and remove vulnerable kernels from normal boot options.
Validation and detection
- Record each system's running kernel version and distribution package revision.
- Compare package revisions with vendor advisories and the referenced stable fixes.
- Confirm the updated kernel is active after reboot, not merely installed.
- Review kernel logs for TLS parser warnings or related unexpected socket failures.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-37756 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/7bdcf5bc35ae59fc4a0fa23276e84b4d1534a3cfCVE reference, Linux
- https://git.kernel.org/stable/c/ac91c6125468be720eafde9c973994cb45b61d44CVE reference, Linux
- https://git.kernel.org/stable/c/f3ce4d3f874ab7919edca364c147ac735f9f1d04CVE reference, Linux
- https://git.kernel.org/stable/c/2bcad8fefcecdd5f005d8c550b25d703c063c34aCVE reference, Linux
- https://git.kernel.org/stable/c/9fcbca0f801580cbb583e9cb274e2c7fbe766ca6CVE reference, Linux
- https://git.kernel.org/stable/c/c665bef891e8972e1d3ce5bbc0d42a373346a2c3CVE reference, Linux
- https://git.kernel.org/stable/c/8513411ec321942bd3cfed53d5bb700665c67d86CVE reference, Linux
- https://git.kernel.org/stable/c/5071a1e606b30c0c11278d3c6620cd6a24724cf6CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/05/msg00045.htmlCVE reference, CVE
- https://lists.debian.org/debian-lts-announce/2025/05/msg00030.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.