CVE-2025-37756

In the Linux kernel, the following vulnerability has been resolved:

net: tls: explicitly disallow disconnect

syzbot discovered that it can disconnect a TLS socket and then run into all sort of unexpected corner cases. I have a vague recollection of Eric pointing this out to us a long time ago. Supporting disconnect is really hard, for one thing if offload is enabled we'd need to wait for all packets to be acked. Disconnect is not commonly used, disallow it.

The immediate problem syzbot run into is the warning in the strp, but that's just the easiest bug to trigger:

WARNING: CPU: 0 PID: 5834 at net/tls/tlsstrp.c:486 tlsstrpmsgload+0x72e/0xa80 net/tls/tlsstrp.c:486 RIP: 0010:tlsstrpmsgload+0x72e/0xa80 net/tls/tlsstrp.c:486 Call Trace: <TASK> tlsrxrecwait+0x280/0xa60 net/tls/tlssw.c:1363 tlsswrecvmsg+0x85c/0x1c30 net/tls/tlssw.c:2043 inet6recvmsg+0x2c9/0x730 net/ipv6/afinet6.c:678 sockrecvmsgnosec net/socket.c:1023 [inline] sock_recvmsg+0x109/0x280 net/socket.c:1045 _sysrecvfrom+0x202/0x380 net/socket.c:2237