GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2025-37814 (GCVE-0-2025-37814)

Vulnerability from cvelistv5 – Published: 2025-05-08 06:26 – Updated: 2026-08-05 11:57
VLAI
Title
tty: Require CAP_SYS_ADMIN for all usages of TIOCL_SELMOUSEREPORT
Summary
In the Linux kernel, the following vulnerability has been resolved: tty: Require CAP_SYS_ADMIN for all usages of TIOCL_SELMOUSEREPORT This requirement was overeagerly loosened in commit 2f83e38a095f ("tty: Permit some TIOCL_SETSEL modes without CAP_SYS_ADMIN"), but as it turns out, (1) the logic I implemented there was inconsistent (apologies!), (2) TIOCL_SELMOUSEREPORT might actually be a small security risk after all, and (3) TIOCL_SELMOUSEREPORT is only meant to be used by the mouse daemon (GPM or Consolation), which runs as CAP_SYS_ADMIN already. In more detail: 1. The previous patch has inconsistent logic: In commit 2f83e38a095f ("tty: Permit some TIOCL_SETSEL modes without CAP_SYS_ADMIN"), we checked for sel_mode == TIOCL_SELMOUSEREPORT, but overlooked that the lower four bits of this "mode" parameter were actually used as an additional way to pass an argument. So the patch did actually still require CAP_SYS_ADMIN, if any of the mouse button bits are set, but did not require it if none of the mouse buttons bits are set. This logic is inconsistent and was not intentional. We should have the same policies for using TIOCL_SELMOUSEREPORT independent of the value of the "hidden" mouse button argument. I sent a separate documentation patch to the man page list with more details on TIOCL_SELMOUSEREPORT: https://lore.kernel.org/all/20250223091342.35523-2-gnoack3000@gmail.com/ 2. TIOCL_SELMOUSEREPORT is indeed a potential security risk which can let an attacker simulate "keyboard" input to command line applications on the same terminal, like TIOCSTI and some other TIOCLINUX "selection mode" IOCTLs. By enabling mouse reporting on a terminal and then injecting mouse reports through TIOCL_SELMOUSEREPORT, an attacker can simulate mouse movements on the same terminal, similar to the TIOCSTI keystroke injection attacks that were previously possible with TIOCSTI and other TIOCL_SETSEL selection modes. Many programs (including libreadline/bash) are then prone to misinterpret these mouse reports as normal keyboard input because they do not expect input in the X11 mouse protocol form. The attacker does not have complete control over the escape sequence, but they can at least control the values of two consecutive bytes in the binary mouse reporting escape sequence. I went into more detail on that in the discussion at https://lore.kernel.org/all/20250221.0a947528d8f3@gnoack.org/ It is not equally trivial to simulate arbitrary keystrokes as it was with TIOCSTI (commit 83efeeeb3d04 ("tty: Allow TIOCSTI to be disabled")), but the general mechanism is there, and together with the small number of existing legit use cases (see below), it would be better to revert back to requiring CAP_SYS_ADMIN for TIOCL_SELMOUSEREPORT, as it was already the case before commit 2f83e38a095f ("tty: Permit some TIOCL_SETSEL modes without CAP_SYS_ADMIN"). 3. TIOCL_SELMOUSEREPORT is only used by the mouse daemons (GPM or Consolation), and they are the only legit use case: To quote console_codes(4): The mouse tracking facility is intended to return xterm(1)-compatible mouse status reports. Because the console driver has no way to know the device or type of the mouse, these reports are returned in the console input stream only when the virtual terminal driver receives a mouse update ioctl. These ioctls must be generated by a mouse-aware user-mode application such as the gpm(8) daemon. Jared Finder has also confirmed in https://lore.kernel.org/all/491f3df9de6593df8e70dbe77614b026@finder.org/ that Emacs does not call TIOCL_SELMOUSEREPORT directly, and it would be difficult to find good reasons for doing that, given that it would interfere with the reports that GPM is sending. More information on the interaction between GPM, terminals and th ---truncated---
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: e46d91ca504d69ae3d09c120b162a238b8013890 , < 6f021bc0083b96125fdbed6a60d7b4396c4d6dac (git)
Affected: 2f83e38a095f8bf7c6029883d894668b03b9bd93 , < 9b50c9c97db953de756a39af83d4be4d7f618aa6 (git)
Affected: 2f83e38a095f8bf7c6029883d894668b03b9bd93 , < ee6a44da3c87cf64d67dd02be8c0127a5bf56175 (git)
Affected: 2714ffdbb79b48dda03334a01af90fb024f39047 (git)
Affected: 6.12.14 , < 6.12.26 (semver)
Affected: 6.13.3 , < 6.14 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 6.14
Unaffected: 0 , < 6.14 (semver)
Unaffected: 6.12.26 , ≤ 6.12.* (semver)
Unaffected: 6.14.5 , ≤ 6.14.* (semver)
Unaffected: 6.15 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/tty/vt/selection.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6f021bc0083b96125fdbed6a60d7b4396c4d6dac",
              "status": "affected",
              "version": "e46d91ca504d69ae3d09c120b162a238b8013890",
              "versionType": "git"
            },
            {
              "lessThan": "9b50c9c97db953de756a39af83d4be4d7f618aa6",
              "status": "affected",
              "version": "2f83e38a095f8bf7c6029883d894668b03b9bd93",
              "versionType": "git"
            },
            {
              "lessThan": "ee6a44da3c87cf64d67dd02be8c0127a5bf56175",
              "status": "affected",
              "version": "2f83e38a095f8bf7c6029883d894668b03b9bd93",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "2714ffdbb79b48dda03334a01af90fb024f39047",
              "versionType": "git"
            },
            {
              "lessThan": "6.12.26",
              "status": "affected",
              "version": "6.12.14",
              "versionType": "semver"
            },
            {
              "lessThan": "6.14",
              "status": "affected",
              "version": "6.13.3",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/tty/vt/selection.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.14"
            },
            {
              "lessThan": "6.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.26",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.14.*",
              "status": "unaffected",
              "version": "6.14.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.15",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.26",
                  "versionStartIncluding": "6.12.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14.5",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.13.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntty: Require CAP_SYS_ADMIN for all usages of TIOCL_SELMOUSEREPORT\n\nThis requirement was overeagerly loosened in commit 2f83e38a095f\n(\"tty: Permit some TIOCL_SETSEL modes without CAP_SYS_ADMIN\"), but as\nit turns out,\n\n  (1) the logic I implemented there was inconsistent (apologies!),\n\n  (2) TIOCL_SELMOUSEREPORT might actually be a small security risk\n      after all, and\n\n  (3) TIOCL_SELMOUSEREPORT is only meant to be used by the mouse\n      daemon (GPM or Consolation), which runs as CAP_SYS_ADMIN\n      already.\n\nIn more detail:\n\n1. The previous patch has inconsistent logic:\n\n   In commit 2f83e38a095f (\"tty: Permit some TIOCL_SETSEL modes\n   without CAP_SYS_ADMIN\"), we checked for sel_mode ==\n   TIOCL_SELMOUSEREPORT, but overlooked that the lower four bits of\n   this \"mode\" parameter were actually used as an additional way to\n   pass an argument.  So the patch did actually still require\n   CAP_SYS_ADMIN, if any of the mouse button bits are set, but did not\n   require it if none of the mouse buttons bits are set.\n\n   This logic is inconsistent and was not intentional.  We should have\n   the same policies for using TIOCL_SELMOUSEREPORT independent of the\n   value of the \"hidden\" mouse button argument.\n\n   I sent a separate documentation patch to the man page list with\n   more details on TIOCL_SELMOUSEREPORT:\n   https://lore.kernel.org/all/20250223091342.35523-2-gnoack3000@gmail.com/\n\n2. TIOCL_SELMOUSEREPORT is indeed a potential security risk which can\n   let an attacker simulate \"keyboard\" input to command line\n   applications on the same terminal, like TIOCSTI and some other\n   TIOCLINUX \"selection mode\" IOCTLs.\n\n   By enabling mouse reporting on a terminal and then injecting mouse\n   reports through TIOCL_SELMOUSEREPORT, an attacker can simulate\n   mouse movements on the same terminal, similar to the TIOCSTI\n   keystroke injection attacks that were previously possible with\n   TIOCSTI and other TIOCL_SETSEL selection modes.\n\n   Many programs (including libreadline/bash) are then prone to\n   misinterpret these mouse reports as normal keyboard input because\n   they do not expect input in the X11 mouse protocol form.  The\n   attacker does not have complete control over the escape sequence,\n   but they can at least control the values of two consecutive bytes\n   in the binary mouse reporting escape sequence.\n\n   I went into more detail on that in the discussion at\n   https://lore.kernel.org/all/20250221.0a947528d8f3@gnoack.org/\n\n   It is not equally trivial to simulate arbitrary keystrokes as it\n   was with TIOCSTI (commit 83efeeeb3d04 (\"tty: Allow TIOCSTI to be\n   disabled\")), but the general mechanism is there, and together with\n   the small number of existing legit use cases (see below), it would\n   be better to revert back to requiring CAP_SYS_ADMIN for\n   TIOCL_SELMOUSEREPORT, as it was already the case before\n   commit 2f83e38a095f (\"tty: Permit some TIOCL_SETSEL modes without\n   CAP_SYS_ADMIN\").\n\n3. TIOCL_SELMOUSEREPORT is only used by the mouse daemons (GPM or\n   Consolation), and they are the only legit use case:\n\n   To quote console_codes(4):\n\n     The mouse tracking facility is intended to return\n     xterm(1)-compatible mouse status reports.  Because the console\n     driver has no way to know the device or type of the mouse, these\n     reports are returned in the console input stream only when the\n     virtual terminal driver receives a mouse update ioctl.  These\n     ioctls must be generated by a mouse-aware user-mode application\n     such as the gpm(8) daemon.\n\n   Jared Finder has also confirmed in\n   https://lore.kernel.org/all/491f3df9de6593df8e70dbe77614b026@finder.org/\n   that Emacs does not call TIOCL_SELMOUSEREPORT directly, and it\n   would be difficult to find good reasons for doing that, given that\n   it would interfere with the reports that GPM is sending.\n\n   More information on the interaction between GPM, terminals and th\n---truncated---"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires a local `ioctl(TIOCLINUX, TIOCL_SETSEL)` on a Linux virtual console device (/dev/ttyN) that is the attacker\u0027s controlling terminal. There is no remote or network-facing path to `tioclinux()`.\nAC:L - The attacker controls every precondition: it enables mouse reporting itself by writing `\\033[?1000h` to the shared VT, then issues the ioctl deterministically with no race, no memory-layout dependency, and on the default CONFIG_VT=y configuration shipped by all distributions.\nPR:L - Only an ordinary unprivileged local account is needed \u2014 the sole gate is `current-\u003esignal-\u003etty == tty`, which any process running on the console satisfies, and the removed `CAP_SYS_ADMIN` check was precisely the bug.\nUI:N - The injected bytes are pushed into the tty flip buffer and are consumed automatically by whatever privileged process next reads the terminal; no victim action is required for the injection itself to land.\nS:U - Both the attacking process and the impacted privileged terminal session are managed by the same security authority \u2014 the kernel \u2014 so this is standard same-scope local privilege escalation.\nC:H - Successful input injection into a root shell lets the attacker drive commands whose output goes to the shared tty that the attacker still holds open and can read, yielding disclosure of arbitrary root-readable data.\nI:H - The flaw is a keystroke-injection primitive into a higher-privileged session \u2014 the maintainer states \"the general mechanism is there\" \u2014 and repeated calls accumulate attacker-chosen bytes in the privileged shell\u0027s line buffer, giving root-level command execution and arbitrary modification of system state.\nA:H - The attacker can flood the privileged terminal\u0027s input queue to wedge and corrupt that session, and the resulting root-level command injection permits fully destructive actions such as shutdown or data deletion."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:57:43.544Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/6f021bc0083b96125fdbed6a60d7b4396c4d6dac"
        },
        {
          "url": "https://git.kernel.org/stable/c/9b50c9c97db953de756a39af83d4be4d7f618aa6"
        },
        {
          "url": "https://git.kernel.org/stable/c/ee6a44da3c87cf64d67dd02be8c0127a5bf56175"
        }
      ],
      "title": "tty: Require CAP_SYS_ADMIN for all usages of TIOCL_SELMOUSEREPORT",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-37814",
    "datePublished": "2025-05-08T06:26:10.723Z",
    "dateReserved": "2025-04-16T04:51:23.946Z",
    "dateUpdated": "2026-08-05T11:57:43.544Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-37814",
      "date": "2026-09-16",
      "epss": "0.00212",
      "percentile": "0.11659"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-37814\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-05-08T07:15:52.623\",\"lastModified\":\"2026-07-30T06:22:22.117\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ntty: Require CAP_SYS_ADMIN for all usages of TIOCL_SELMOUSEREPORT\\n\\nThis requirement was overeagerly loosened in commit 2f83e38a095f\\n(\\\"tty: Permit some TIOCL_SETSEL modes without CAP_SYS_ADMIN\\\"), but as\\nit turns out,\\n\\n  (1) the logic I implemented there was inconsistent (apologies!),\\n\\n  (2) TIOCL_SELMOUSEREPORT might actually be a small security risk\\n      after all, and\\n\\n  (3) TIOCL_SELMOUSEREPORT is only meant to be used by the mouse\\n      daemon (GPM or Consolation), which runs as CAP_SYS_ADMIN\\n      already.\\n\\nIn more detail:\\n\\n1. The previous patch has inconsistent logic:\\n\\n   In commit 2f83e38a095f (\\\"tty: Permit some TIOCL_SETSEL modes\\n   without CAP_SYS_ADMIN\\\"), we checked for sel_mode ==\\n   TIOCL_SELMOUSEREPORT, but overlooked that the lower four bits of\\n   this \\\"mode\\\" parameter were actually used as an additional way to\\n   pass an argument.  So the patch did actually still require\\n   CAP_SYS_ADMIN, if any of the mouse button bits are set, but did not\\n   require it if none of the mouse buttons bits are set.\\n\\n   This logic is inconsistent and was not intentional.  We should have\\n   the same policies for using TIOCL_SELMOUSEREPORT independent of the\\n   value of the \\\"hidden\\\" mouse button argument.\\n\\n   I sent a separate documentation patch to the man page list with\\n   more details on TIOCL_SELMOUSEREPORT:\\n   https://lore.kernel.org/all/20250223091342.35523-2-gnoack3000@gmail.com/\\n\\n2. TIOCL_SELMOUSEREPORT is indeed a potential security risk which can\\n   let an attacker simulate \\\"keyboard\\\" input to command line\\n   applications on the same terminal, like TIOCSTI and some other\\n   TIOCLINUX \\\"selection mode\\\" IOCTLs.\\n\\n   By enabling mouse reporting on a terminal and then injecting mouse\\n   reports through TIOCL_SELMOUSEREPORT, an attacker can simulate\\n   mouse movements on the same terminal, similar to the TIOCSTI\\n   keystroke injection attacks that were previously possible with\\n   TIOCSTI and other TIOCL_SETSEL selection modes.\\n\\n   Many programs (including libreadline/bash) are then prone to\\n   misinterpret these mouse reports as normal keyboard input because\\n   they do not expect input in the X11 mouse protocol form.  The\\n   attacker does not have complete control over the escape sequence,\\n   but they can at least control the values of two consecutive bytes\\n   in the binary mouse reporting escape sequence.\\n\\n   I went into more detail on that in the discussion at\\n   https://lore.kernel.org/all/20250221.0a947528d8f3@gnoack.org/\\n\\n   It is not equally trivial to simulate arbitrary keystrokes as it\\n   was with TIOCSTI (commit 83efeeeb3d04 (\\\"tty: Allow TIOCSTI to be\\n   disabled\\\")), but the general mechanism is there, and together with\\n   the small number of existing legit use cases (see below), it would\\n   be better to revert back to requiring CAP_SYS_ADMIN for\\n   TIOCL_SELMOUSEREPORT, as it was already the case before\\n   commit 2f83e38a095f (\\\"tty: Permit some TIOCL_SETSEL modes without\\n   CAP_SYS_ADMIN\\\").\\n\\n3. TIOCL_SELMOUSEREPORT is only used by the mouse daemons (GPM or\\n   Consolation), and they are the only legit use case:\\n\\n   To quote console_codes(4):\\n\\n     The mouse tracking facility is intended to return\\n     xterm(1)-compatible mouse status reports.  Because the console\\n     driver has no way to know the device or type of the mouse, these\\n     reports are returned in the console input stream only when the\\n     virtual terminal driver receives a mouse update ioctl.  These\\n     ioctls must be generated by a mouse-aware user-mode application\\n     such as the gpm(8) daemon.\\n\\n   Jared Finder has also confirmed in\\n   https://lore.kernel.org/all/491f3df9de6593df8e70dbe77614b026@finder.org/\\n   that Emacs does not call TIOCL_SELMOUSEREPORT directly, and it\\n   would be difficult to find good reasons for doing that, given that\\n   it would interfere with the reports that GPM is sending.\\n\\n   More information on the interaction between GPM, terminals and th\\n---truncated---\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: tty: Requerir CAP_SYS_ADMIN para todos los usos de TIOCL_SELMOUSEREPORT Este requisito se flexibiliz\u00f3 con mucho entusiasmo en el commit 2f83e38a095f (\\\"tty: Permitir algunos modos TIOCL_SETSEL sin CAP_SYS_ADMIN\\\"), pero resulta que (1) la l\u00f3gica que implement\u00e9 all\u00ed era inconsistente (\u00a1disculpas!), (2) TIOCL_SELMOUSEREPORT en realidad puede ser un peque\u00f1o riesgo de seguridad despu\u00e9s de todo, y (3) TIOCL_SELMOUSEREPORT solo est\u00e1 destinado a ser utilizado por el demonio del mouse (GPM o Consolation), que ya se ejecuta como CAP_SYS_ADMIN. M\u00e1s detalles: 1. El parche anterior tiene una l\u00f3gica inconsistente: En el commit 2f83e38a095f (\\\"tty: Permitir algunos modos TIOCL_SETSEL sin CAP_SYS_ADMIN\\\"), verificamos que sel_mode == TIOCL_SELMOUSEREPORT, pero pasamos por alto que los cuatro bits inferiores de este par\u00e1metro \\\"mode\\\" se usaban como una forma adicional de pasar un argumento. Por lo tanto, el parche segu\u00eda requiriendo CAP_SYS_ADMIN si alguno de los bits del bot\u00f3n del rat\u00f3n estaba configurado, pero no lo requer\u00eda si ninguno de los bits del bot\u00f3n del rat\u00f3n estaba configurado. Esta l\u00f3gica es inconsistente y no fue intencional. Deber\u00edamos tener las mismas pol\u00edticas para usar TIOCL_SELMOUSEREPORT, independientemente del valor del argumento \\\"oculto\\\" del bot\u00f3n del rat\u00f3n. Envi\u00e9 un parche de documentaci\u00f3n aparte a la lista de p\u00e1ginas del manual con m\u00e1s detalles sobre TIOCL_SELMOUSEREPORT: https://lore.kernel.org/all/20250223091342.35523-2-gnoack3000@gmail.com/ 2. TIOCL_SELMOUSEREPORT constituye un riesgo de seguridad potencial que puede permitir a un atacante simular la entrada de teclado en aplicaciones de l\u00ednea de comandos en la misma terminal, como TIOCSTI y otras IOCTL de \\\"modo de selecci\u00f3n\\\" de TIOCLINUX. Al habilitar los informes del rat\u00f3n en una terminal y luego inyectarlos mediante TIOCL_SELMOUSEREPORT, un atacante puede simular los movimientos del rat\u00f3n en la misma terminal, de forma similar a los ataques de inyecci\u00f3n de pulsaciones de teclas de TIOCSTI que antes eran posibles con TIOCSTI y otros modos de selecci\u00f3n de TIOCL_SETSEL. Muchos programas (incluidos libreadline/bash) tienden a malinterpretar estos informes del rat\u00f3n como una entrada normal del teclado, ya que no esperan una entrada en el formato del protocolo X11. El atacante no tiene control total sobre la secuencia de escape, pero al menos puede controlar los valores de dos bytes consecutivos en la secuencia de escape binaria del informe del rat\u00f3n. Entr\u00e9 en m\u00e1s detalles sobre eso en la discusi\u00f3n en https://lore.kernel.org/all/20250221.0a947528d8f3@gnoack.org/ No es igualmente trivial simular pulsaciones de teclas arbitrarias como lo fue con TIOCSTI (commit 83efeeeb3d04 (\\\"tty: Permitir que TIOCSTI sea deshabilitado\\\")), pero el mecanismo general est\u00e1 ah\u00ed, y junto con la peque\u00f1a cantidad de casos de uso leg\u00edtimos existentes (ver a continuaci\u00f3n), ser\u00eda mejor volver a requerir CAP_SYS_ADMIN para TIOCL_SELMOUSEREPORT, como ya era el caso antes del commit 2f83e38a095f (\\\"tty: Permitir algunos modos TIOCL_SETSEL sin CAP_SYS_ADMIN\\\"). 3. TIOCL_SELMOUSEREPORT solo lo utilizan los daemons de rat\u00f3n (GPM o Consolation), y son el \u00fanico caso de uso leg\u00edtimo: Para citar console_codes(4): La funci\u00f3n de seguimiento del rat\u00f3n est\u00e1 dise\u00f1ada para devolver informes de estado del rat\u00f3n compatibles con xterm(1). Dado que el controlador de consola no puede conocer el dispositivo ni el tipo de rat\u00f3n, estos informes se devuelven en el flujo de entrada de la consola solo cuando el controlador del terminal virtual recibe una instrucci\u00f3n ioctl de actualizaci\u00f3n del rat\u00f3n. Estas instrucciones ioctl deben ser generadas por una aplicaci\u00f3n en modo usuario que admita el rat\u00f3n, como el daemon gpm(8). Jared Finder tambi\u00e9n ha confirmado en https://lore.kernel.org/all/491f3df9de6593df8e70dbe77614b026@finder.org/ que Emacs no llama a TIOCL_SELMOUSEREPORT directamente, y ser\u00eda dif\u00edcil encontrar buenas razones para hacerlo, dado que interferir\u00eda con los  ---truncado---\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/tty/vt/selection.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"e46d91ca504d69ae3d09c120b162a238b8013890\",\"lessThan\":\"6f021bc0083b96125fdbed6a60d7b4396c4d6dac\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2f83e38a095f8bf7c6029883d894668b03b9bd93\",\"lessThan\":\"9b50c9c97db953de756a39af83d4be4d7f618aa6\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2f83e38a095f8bf7c6029883d894668b03b9bd93\",\"lessThan\":\"ee6a44da3c87cf64d67dd02be8c0127a5bf56175\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2714ffdbb79b48dda03334a01af90fb024f39047\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6.12.14\",\"lessThan\":\"6.12.26\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.13.3\",\"lessThan\":\"6.14\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/tty/vt/selection.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.14\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.14\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.26\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.14.5\",\"lessThanOrEqual\":\"6.14.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.15\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.12.14\",\"versionEndExcluding\":\"6.12.26\",\"matchCriteriaId\":\"FB57AC18-E610-47A0-8FB9-4E7B33786DB2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13.3\",\"versionEndExcluding\":\"6.14.5\",\"matchCriteriaId\":\"3BC8EBDC-B82F-4820-8745-5A27E5F53971\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.15:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"8D465631-2980-487A-8E65-40AE2B9F8ED1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.15:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"4C9D071F-B28E-46EC-AC61-22B913390211\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.15:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"13FC0DDE-E513-465E-9E81-515702D49B74\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/6f021bc0083b96125fdbed6a60d7b4396c4d6dac\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9b50c9c97db953de756a39af83d4be4d7f618aa6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ee6a44da3c87cf64d67dd02be8c0127a5bf56175\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-30T09:32:21+00:00",
      "cve": "CVE-2025-37814",
      "id": "CVE-2025-37814",
      "initial_release_date": "2025-05-08T00:00:00+00:00",
      "product_status:known_affected": "28",
      "product_status:known_not_affected": "246",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: tty: Require CAP_SYS_ADMIN for all usages of TIOCL_SELMOUSEREPORT",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-37814.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.