{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2025-37752", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T04:51:23.937Z", "datePublished": "2025-05-01T12:55:57.280Z", "dateUpdated": "2026-08-05T11:57:17.026Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:57:17.026Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet_sched: sch_sfq: move the limit validation\n\nIt is not sufficient to directly validate the limit on the data that\nthe user passes as it can be updated based on how the other parameters\nare changed.\n\nMove the check at the end of the configuration update process to also\ncatch scenarios where the limit is indirectly updated, for example\nwith the following configurations:\n\ntc qdisc add dev dummy0 handle 1: root sfq limit 2 flows 1 depth 1\ntc qdisc add dev dummy0 handle 1: root sfq limit 2 flows 1 divisor 1\n\nThis fixes the following syzkaller reported crash:\n\n------------[ cut here ]------------\nUBSAN: array-index-out-of-bounds in net/sched/sch_sfq.c:203:6\nindex 65535 is out of range for type 'struct sfq_head[128]'\nCPU: 1 UID: 0 PID: 3037 Comm: syz.2.16 Not tainted 6.14.0-rc2-syzkaller #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024\nCall Trace:\n \n __dump_stack lib/dump_stack.c:94 [inline]\n dump_stack_lvl+0x201/0x300 lib/dump_stack.c:120\n ubsan_epilogue lib/ubsan.c:231 [inline]\n __ubsan_handle_out_of_bounds+0xf5/0x120 lib/ubsan.c:429\n sfq_link net/sched/sch_sfq.c:203 [inline]\n sfq_dec+0x53c/0x610 net/sched/sch_sfq.c:231\n sfq_dequeue+0x34e/0x8c0 net/sched/sch_sfq.c:493\n sfq_reset+0x17/0x60 net/sched/sch_sfq.c:518\n qdisc_reset+0x12e/0x600 net/sched/sch_generic.c:1035\n tbf_reset+0x41/0x110 net/sched/sch_tbf.c:339\n qdisc_reset+0x12e/0x600 net/sched/sch_generic.c:1035\n dev_reset_queue+0x100/0x1b0 net/sched/sch_generic.c:1311\n netdev_for_each_tx_queue include/linux/netdevice.h:2590 [inline]\n dev_deactivate_many+0x7e5/0xe70 net/sched/sch_generic.c:1375" } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The vulnerability is reached only by configuring an SFQ qdisc through RTM_NEWQDISC netlink messages plus locally generated traffic; per kernel scoring guidance tc/netlink qdisc configuration is a local attack surface with no remote or adjacent reachability.\nAC:L - The attacker fully controls every precondition — the TBF-over-SFQ hierarchy, the `limit 2 flows 1 depth 1` parameters that collapse the effective limit to 1, and the packet injection that drives the qlen underflow — and the upstream commit ships a deterministic shell reproducer with no race or memory-layout dependency.\nPR:L - Qdisc configuration requires CAP_NET_ADMIN only over the target network namespace (`netlink_net_capable()` in net/core/rtnetlink.c), which any unprivileged user obtains with `unshare -Urn`, and the loopback device inside that namespace is sufficient to drive the traffic.\nUI:N - The attacker performs the qdisc setup and packet transmission entirely on its own; no victim action, mount, or interaction is required.\nS:U - The corruption occurs in kernel heap memory within the same security authority as the attacker's escalation target, with no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - `n = q->dep[65535].next` reads a u16 from roughly 256 KB beyond the ~1.4 KB kzalloc'd qdisc object, and the resulting out-of-bounds heap corruption is of the class that can be leveraged into an arbitrary-read primitive against adjacent kernel objects.\nI:H - Two out-of-bounds writes occur — `q->dep[65535].next = x` at a fixed +262140-byte offset and `sfq_dep_head(q, n)->prev = x` at an offset derived from groomable heap contents — giving an attacker-influenced write of an attacker-chosen u16 into unrelated slab memory, an exploitable control-flow corruption primitive.\nA:H - The access is an array-index-out-of-bounds flagged by UBSAN (panicking on panic_on_warn kernels) and, absent instrumentation, silently corrupts unrelated kernel memory or touches unmapped addresses, causing oops or panic; the sequence can be repeated at will." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/sched/sch_sfq.c" ], "versions": [ { "version": "e12f6013d0a69660e8b99bfe381b9546ae667328", "lessThan": "8fadc871a42933aacb7f1ce9ed9a96485e2c9cf4", "status": "affected", "versionType": "git" }, { "version": "1e6d9d87626cf89eeffb4d943db12cb5b10bf961", "lessThan": "7d62ded97db6b7c94c891f704151f372b1ba4688", "status": "affected", "versionType": "git" }, { "version": "1b562b7f9231432da40d12e19786c1bd7df653a7", "lessThan": "6c589aa318023690f1606c666a7fb5f4c1c9c219", "status": "affected", "versionType": "git" }, { "version": "35d0137305ae2f97260a9047f445bd4434bd6cc7", "lessThan": "1348214fa042a71406964097e743c87a42c85a49", "status": "affected", "versionType": "git" }, { "version": "833e9a1c27b82024db7ff5038a51651f48f05e5e", "lessThan": "d2718324f9e329b10ddc091fba5a0ba2b9d4d96a", "status": "affected", "versionType": "git" }, { "version": "7d8947f2153ee9c5ab4cb17861a11cc45f30e8c4", "lessThan": "f86293adce0c201cfabb283ef9d6f21292089bb8", "status": "affected", "versionType": "git" }, { "version": "7fefc294204f10a3405f175f4ac2be16d63f135e", "lessThan": "5e5e1fcc1b8ed57f902c424c5d9b328a3a19073d", "status": "affected", "versionType": "git" }, { "version": "10685681bafce6febb39770f3387621bf5d67d0b", "lessThan": "b36a68192037d1614317a09b0d78c7814e2eecf9", "status": "affected", "versionType": "git" }, { "version": "10685681bafce6febb39770f3387621bf5d67d0b", "lessThan": "b3bf8f63e6179076b57c9de660c9f80b5abefe70", "status": "affected", "versionType": "git" }, { "version": "6.1.129", "lessThan": "6.1.135", "status": "affected", "versionType": "semver" }, { "version": "6.6.76", "lessThan": "6.6.88", "status": "affected", "versionType": "semver" }, { "version": "6.12.13", "lessThan": "6.12.24", "status": "affected", "versionType": "semver" }, { "version": "6.13.2", "lessThan": "6.13.12", "status": "affected", "versionType": "semver" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/sched/sch_sfq.c" ], "versions": [ { "version": "6.14", "status": "affected" }, { "version": "0", "lessThan": "6.14", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.135", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.88", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.24", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.13.12", "lessThanOrEqual": "6.13.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.14.3", "lessThanOrEqual": "6.14.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.15", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1.129", "versionEndExcluding": "6.1.135" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6.76", "versionEndExcluding": "6.6.88" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12.13", "versionEndExcluding": "6.12.24" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.13.2", "versionEndExcluding": "6.13.12" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.14", "versionEndExcluding": "6.14.3" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.14", "versionEndExcluding": "6.15" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/8fadc871a42933aacb7f1ce9ed9a96485e2c9cf4" }, { "url": "https://git.kernel.org/stable/c/7d62ded97db6b7c94c891f704151f372b1ba4688" }, { "url": "https://git.kernel.org/stable/c/6c589aa318023690f1606c666a7fb5f4c1c9c219" }, { "url": "https://git.kernel.org/stable/c/1348214fa042a71406964097e743c87a42c85a49" }, { "url": "https://git.kernel.org/stable/c/d2718324f9e329b10ddc091fba5a0ba2b9d4d96a" }, { "url": "https://git.kernel.org/stable/c/f86293adce0c201cfabb283ef9d6f21292089bb8" }, { "url": "https://git.kernel.org/stable/c/5e5e1fcc1b8ed57f902c424c5d9b328a3a19073d" }, { "url": "https://git.kernel.org/stable/c/b36a68192037d1614317a09b0d78c7814e2eecf9" }, { "url": "https://git.kernel.org/stable/c/b3bf8f63e6179076b57c9de660c9f80b5abefe70" } ], "title": "net_sched: sch_sfq: move the limit validation", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "title": "CVE Program Container", "references": [ { "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html" } ], "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T19:54:26.177Z" } } ] } }