CVE-2025-37814 is a vulnerability in the Linux kernel related to the handling of the TIOCL_SELMOUSEREPORT ioctl command within the tty subsystem. This ioctl is used to enable mouse reporting on virtual terminals, primarily intended for mouse daemons such as GPM (General Purpose Mouse) or Consolation, which run with CAP_SYS_ADMIN privileges. Previously, a patch (commit 2f83e38a095f) had loosened the requirement for CAP_SYS_ADMIN for some TIOCL_SETSEL modes, including TIOCL_SELMOUSEREPORT, but this was done with inconsistent logic. Specifically, the patch failed to consider that the lower four bits of the mode parameter could carry additional arguments, leading to a scenario where TIOCL_SELMOUSEREPORT could be invoked without CAP_SYS_ADMIN if no mouse button bits were set. This inconsistency introduced a security risk. The core risk arises because TIOCL_SELMOUSEREPORT allows injecting mouse reports into the terminal input stream. Attackers with access to this ioctl could simulate mouse movements and clicks, which many terminal applications (including libreadline and bash) might misinterpret as legitimate keyboard input due to their handling of X11 mouse protocol escape sequences. While this injection is less powerful than the previously known TIOCSTI ioctl (which allowed arbitrary keystroke injection), it still enables partial input simulation that could be exploited for command injection or privilege escalation on the same terminal session. The vulnerability was addressed by reverting the requirement that all uses of TIOCL_SELMOUSEREPORT require CAP_SYS_ADMIN, restoring the original security posture. This change ensures that only trusted processes (like mouse daemons running with administrative capabilities) can use this ioctl, mitigating the risk of unauthorized input injection. This vulnerability highlights the subtle security implications of ioctl permissions and the importance of strict capability checks in kernel interfaces that interact with user input streams.

For European organizations, especially those running Linux servers or workstations with virtual terminals and mouse daemons, this vulnerability could allow local attackers or compromised low-privilege users to inject input events into terminal sessions. This could lead to unauthorized command execution, privilege escalation, or disruption of terminal-based workflows. Organizations relying on Linux for critical infrastructure, development environments, or terminal-based applications could face increased risk of insider threats or lateral movement within networks. While remote exploitation is unlikely without prior access, the vulnerability could be leveraged in multi-user systems, shared hosting environments, or containerized setups where terminal access is shared or exposed. The partial input injection capability may bypass some input validation or logging mechanisms, complicating detection and response. Given the widespread use of Linux across European industries, including finance, manufacturing, and public sector, the vulnerability poses a moderate risk that requires timely patching to prevent exploitation.

1. Apply the official Linux kernel patch that reinstates the CAP_SYS_ADMIN requirement for TIOCL_SELMOUSEREPORT to ensure only trusted processes can invoke this ioctl. 2. Audit and restrict access to terminal devices and ensure that only necessary processes run with CAP_SYS_ADMIN capabilities. 3. Monitor and limit the use of mouse daemons like GPM or Consolation to trusted environments; disable or remove them if not required. 4. Implement strict user privilege separation and avoid granting unnecessary capabilities to untrusted users or processes. 5. Employ terminal input monitoring and anomaly detection to identify unusual mouse or keyboard input sequences that could indicate exploitation attempts. 6. Educate system administrators about the risks of ioctl misuse and encourage regular kernel updates. 7. For environments using containerization or virtualization, ensure that container privileges do not allow unauthorized ioctl access to host terminals. 8. Review and harden terminal application configurations (e.g., bash, libreadline) to handle unexpected input sequences more securely, if possible.