Resource management error in Linux kernel tls

1) Resource management error

EUVDB-ID: #VU108380

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-37756

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the tls_setsockopt() and build_protos() functions in net/tls/tls_main.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Linux kernel: 6.1 - 6.1.134

CPE2.3

• cpe:2.3:o:linux_foundation:linux_kernel:6.1:*:*:*:*:*:*:*
• cpe:2.3:o:linux_foundation:linux_kernel:6.1:rc1:*:*:*:*:*:*
• cpe:2.3:o:linux_foundation:linux_kernel:6.1:rc3:*:*:*:*:*:*
• cpe:2.3:o:linux_foundation:linux_kernel:6.1:rc7:*:*:*:*:*:*
• cpe:2.3:o:linux_foundation:linux_kernel:6.1.1:*:*:*:*:*:*:*
• cpe:2.3:o:linux_foundation:linux_kernel:6.1.2:*:*:*:*:*:*:*
• cpe:2.3:o:linux_foundation:linux_kernel:6.1.3:*:*:*:*:*:*:*
• cpe:2.3:o:linux_foundation:linux_kernel:6.1.4:*:*:*:*:*:*:*
• cpe:2.3:o:linux_foundation:linux_kernel:6.1.5:*:*:*:*:*:*:*
• cpe:2.3:o:linux_foundation:linux_kernel:6.1.6:*:*:*:*:*:*:*

External links

https://git.kernel.org/stable/c/2bcad8fefcecdd5f005d8c550b25d703c063c34a
https://git.kernel.org/stable/c/5071a1e606b30c0c11278d3c6620cd6a24724cf6
https://git.kernel.org/stable/c/7bdcf5bc35ae59fc4a0fa23276e84b4d1534a3cf
https://git.kernel.org/stable/c/8513411ec321942bd3cfed53d5bb700665c67d86
https://git.kernel.org/stable/c/9fcbca0f801580cbb583e9cb274e2c7fbe766ca6
https://git.kernel.org/stable/c/ac91c6125468be720eafde9c973994cb45b61d44
https://git.kernel.org/stable/c/c665bef891e8972e1d3ce5bbc0d42a373346a2c3
https://git.kernel.org/stable/c/f3ce4d3f874ab7919edca364c147ac735f9f1d04
https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.135

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.