Socket Connection Vulnerability in FreeBSD Network Stack

CVE-2025-24934

What is CVE-2025-24934?

A vulnerability has been identified in the FreeBSD kernel's handling of socket connections within load-balancing groups. When a software application sets the SO_REUSEPORT_LB option on a socket, it connects to a host without immediate observable issues. However, this configuration allows the socket to accept packets from any host due to its membership in a load-balancing group. This behavior deviates from the expected contract of socket connections, leading to potential spoofing attacks, as the underlying kernel fails to verify the connection state of sockets appropriately. This can compromise the security of applications relying on strict socket communication.

References