Security Risk in Linux Kernel: CAP_SYS_ADMIN Requirement Loosened for TIOCL_SELMOUSEREPORT
Summary
DEBIAN-CVE-2025-37814: In the Linux kernel, the following vulnerability has been resolved: tty: Require CAP_SYS_ADMIN for all usages of TIOCL_SELMOUSEREPORT This requirement was overeagerly loosened in commit 2f83e38a095f ("tty: Permit some TI... Affects linux versions < 6.12.27-1. Fixed in 6.12.27-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of the Debian operating system, responsible for managing hardware and system resources. It provides essential services for all other software running on the system. The kernel's security is paramount, as vulnerabilities can lead to unauthorized access or control over the system. This specific vulnerability relates to the handling of mouse reporting in terminal sessions, which could potentially allow attackers to simulate user input.
Vulnerability Detail
In the Linux kernel, the TIOCL_SELMOUSEREPORT functionality was modified to loosen the requirement for CAP_SYS_ADMIN privileges. This change was made in commit 2f83e38a095f, which introduced inconsistent logic regarding the use of this feature. The vulnerability allows an attacker to simulate mouse movements and potentially inject input into command line applications, which could lead to unauthorized actions being performed on the terminal. The oversight poses a security risk, as it can be exploited to mislead applications that do not expect mouse input in the form of X11 mouse protocol.
How To Fix
Minimum fixed version
6.12.27-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict access to terminal sessions or avoid using applications that rely on mouse reporting until the package is updated. Additionally, users can monitor their systems for unauthorized input or behavior while the vulnerability remains unpatched.
Conclusion
The vulnerability in the Linux kernel regarding TIOCL_SELMOUSEREPORT poses a significant security risk by allowing unauthorized input simulation. It is crucial for users to update their systems to the patched version to ensure their security. Monitoring tools like Vulert can assist in identifying vulnerabilities in open-source software.
See every vulnerability recorded for linux →
FAQ
TIOCL_SELMOUSEREPORT is a terminal ioctl command that allows mouse reporting in terminal sessions. It was intended for use by mouse daemons like GPM.
An attacker can exploit this vulnerability by injecting mouse reports into terminal applications, potentially simulating user input and executing unintended commands.
The consequences can include unauthorized access to system resources, data manipulation, or execution of malicious commands through simulated user input.
Yes, a patch is available in version 6.12.27-1 of the Linux package. Users should update to this version to mitigate the vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
