Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.
VOLERION
Volerion Security Research

NOT DEFERRED DATABASE

VULNERABILITIES

CVE-2025-24934 Details

ANALYZED

This CVE record has been analyzed and enriched by NVDAPI.com as an independent party.

Description

Software which sets SO_REUSEPORT_LB on a socket and then connects it to a host will not directly observe any problems. However, due to its membership in a load-balancing group, that socket will receive packets originating from any host. This breaks the contract of the connect(2) and implied connect via sendto(2), and may leave the application vulnerable to spoofing attacks. The kernel failed to check the connection state of sockets when adding them to load-balancing groups. Furthermore, when looking up the destination socket for an incoming packet, the kernel will match a socket belonging to a load-balancing group even if it is connected, in violation of the contract that connected sockets are only supposed to receive packets originating from the connected host.

Metrics

CVSS 3.x Severity and Vector Strings:

NDDVolerionCVSS-B:5.3 MEDIUMVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CNA: CISA-ADPCVSS-B:5.4 MEDIUMVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URLSource(s)Tag(s)
https://security.freebsd.org/advisories/FreeBSD-SA-25:09.netinet.asc [email protected]AdvisoryRemedyVendor
https://www.usenix.org/system/files/conference/usenixsecurity26/sec26_prepub_ben-simhon.pdf [email protected]

Weakness Enumeration

CWE-IDCWE NameSource
CWE-488Exposure of Data Element to Wrong Session[email protected]

Affected Products

ProductVersions
FreeBSD
All versions

CPE

  • cpe:2.3:o:freebsd:freebsd:*:*:*:*:*:*:*:*

Remediation

  • Upgrade: 15.0-STABLEmoderate effort

    To update your vulnerable system via a binary patch: # freebsd-update fetch # freebsd-update install # shutdown -r +10min "Rebooting for a security update"

  • Upgrade: 15.0-BETA2-p1moderate effort

    To update your vulnerable system via a binary patch: # freebsd-update fetch # freebsd-update install # shutdown -r +10min "Rebooting for a security update"

  • Upgrade: 14.3-STABLEmoderate effort

    To update your vulnerable system via a binary patch: # freebsd-update fetch # freebsd-update install # shutdown -r +10min "Rebooting for a security update"

  • Upgrade: 14.3-RELEASE-p5moderate effort

    To update your vulnerable system via a binary patch: # freebsd-update fetch # freebsd-update install # shutdown -r +10min "Rebooting for a security update"

  • Upgrade: 13.4-STABLEmoderate effort

    To update your vulnerable system via a binary patch: # freebsd-update fetch # freebsd-update install # shutdown -r +10min "Rebooting for a security update"

  • Upgrade: 13.5-RELEASE-p6moderate effort

    To update your vulnerable system via a binary patch: # freebsd-update fetch # freebsd-update install # shutdown -r +10min "Rebooting for a security update"

Change History

5 change records found show changes

QUICK INFO

CVE Dictionary Entry:
CVE-2025-24934
NVD Published Date:
Oct 22, 2025
NVD Last Modified:
Jun 17, 2026
Source:
[email protected]
CVE-2025-24934 Details - Not Deferred