Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2025-38193

net_sched: sch_sfq: reject invalid perturb period

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 5.4.297, 5.10.240, 5.15.186, 6.1.142, 6.6.95, and 2 more
None on Exploit-DB, Metasploit or GitHub
  • Exploitation: none
  • Automatable: no
  • Technical impact: total

Summary

In the Linux kernel, the following vulnerability has been resolved: net_sched: sch_sfq: reject invalid perturb period Gerrard Tai reported that SFQ perturb_period has no range check yet, and this can be used to trigger a race condition fixed in a separate patch. We want to make sure ctl->perturb_period * HZ will not overflow and is positive. tc qd add dev lo root sfq perturb -10 # negative value : error Error: sch_sfq: invalid perturb period. tc qd add dev lo root sfq perturb 1000000000 # too big : error Error: sch_sfq: invalid perturb period. tc qd add dev lo root sfq perturb 2000000 # acceptable value tc -s -d qd sh dev lo qdisc sfq 8005: root refcnt 2 limit 127p quantum 64Kb depth 127 flows 128 divisor 1024 perturb 2000000sec Sent 0 bytes 0 pkt (dropped 0, overlimits 0 requeues 0) backlog 0b 0p requeues 0

Timeline

  1. CVE published
  2. CISA SSVC assessment

    Exploitation: none · Automatable: no · Technical impact: total

  3. Record last updated

Affected versions

  • Linux Linux

    From 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 · fixed in e0936ff56be4e08ad5b60ec26971eae0c40af305; From 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 · fixed in 2254d038dab9c194fe6a4b1ce31034f42e91a6e5; From 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 · fixed in 956b5aebb349449b38d920d444ca1392d43719d1; From 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 · fixed in b11a50544af691b787384089b68f740ae20a441b; From 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 · fixed in 0357da9149eac621f39e235a135ebf155f01f7c3; From 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 · fixed in f9b97d466e6026ccbdda30bb5b71965b67ccbc82; From 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 · fixed in 590b2d7d0beadba2aa576708a05a05f0aae39295; From 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 · fixed in 7ca52541c05c832d32b112274f81a985101f9ba8

  • Linux Linux

    2.6.12

  • KernelLinux

    From 2.6.12 · fixed in 5.4.297; From 5.5.0 · fixed in 5.10.240; From 5.11.0 · fixed in 5.15.186; From 5.16.0 · fixed in 6.1.142; From 6.2.0 · fixed in 6.6.95; From 6.7.0 · fixed in 6.12.35; From 6.13.0 · fixed in 6.15.4

References 8

git.kernel.org