{"id":"DEBIAN-CVE-2025-37894","details":"In the Linux kernel, the following vulnerability has been resolved:  net: use sock_gen_put() when sk_state is TCP_TIME_WAIT  It is possible for a pointer of type struct inet_timewait_sock to be returned from the functions __inet_lookup_established() and __inet6_lookup_established(). This can cause a crash when the returned pointer is of type struct inet_timewait_sock and sock_put() is called on it. The following is a crash call stack that shows sk-\u003esk_wmem_alloc being accessed in sk_free() during the call to sock_put() on a struct inet_timewait_sock pointer. To avoid this issue, use sock_gen_put() instead of sock_put() when sk-\u003esk_state is TCP_TIME_WAIT.  mrdump.ko        ipanic() + 120 vmlinux          notifier_call_chain(nr_to_call=-1, nr_calls=0) + 132 vmlinux          atomic_notifier_call_chain(val=0) + 56 vmlinux          panic() + 344 vmlinux          add_taint() + 164 vmlinux          end_report() + 136 vmlinux          kasan_report(size=0) + 236 vmlinux          report_tag_fault() + 16 vmlinux          do_tag_recovery() + 16 vmlinux          __do_kernel_fault() + 88 vmlinux          do_bad_area() + 28 vmlinux          do_tag_check_fault() + 60 vmlinux          do_mem_abort() + 80 vmlinux          el1_abort() + 56 vmlinux          el1h_64_sync_handler() + 124 vmlinux        \u003e 0xFFFFFFC080011294() vmlinux          __lse_atomic_fetch_add_release(v=0xF2FFFF82A896087C) vmlinux          __lse_atomic_fetch_sub_release(v=0xF2FFFF82A896087C) vmlinux          arch_atomic_fetch_sub_release(i=1, v=0xF2FFFF82A896087C) + 8 vmlinux          raw_atomic_fetch_sub_release(i=1, v=0xF2FFFF82A896087C) + 8 vmlinux          atomic_fetch_sub_release(i=1, v=0xF2FFFF82A896087C) + 8 vmlinux          __refcount_sub_and_test(i=1, r=0xF2FFFF82A896087C, oldp=0) + 8 vmlinux          __refcount_dec_and_test(r=0xF2FFFF82A896087C, oldp=0) + 8 vmlinux          refcount_dec_and_test(r=0xF2FFFF82A896087C) + 8 vmlinux          sk_free(sk=0xF2FFFF82A8960700) + 28 vmlinux          sock_put() + 48 vmlinux          tcp6_check_fraglist_gro() + 236 vmlinux          tcp6_gro_receive() + 624 vmlinux          ipv6_gro_receive() + 912 vmlinux          dev_gro_receive() + 1116 vmlinux          napi_gro_receive() + 196 ccmni.ko         ccmni_rx_callback() + 208 ccmni.ko         ccmni_queue_recv_skb() + 388 ccci_dpmaif.ko   dpmaif_rxq_push_thread() + 1088 vmlinux          kthread() + 268 vmlinux          0xFFFFFFC08001F30C()","modified":"2026-08-27T23:05:20.804416651Z","published":"2025-05-20T16:15:25.760Z","upstream":["CVE-2025-37894"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2025-37894"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.29-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2025-37894.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.29-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2025-37894.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}]}