sched: sch_cake: add bounds checks to host bulk flow fairness counts (Linux Linux)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.28 % · percentile 21 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- Linux
- NVD status
- Modified
Description
In the Linux kernel, the following vulnerability has been resolved: sched: sch_cake: add bounds checks to host bulk flow fairness counts Even though we fixed a logic error in the commit cited below, syzbot still managed to trigger an underflow of the per-host bulk flow counters, leading to an out of bounds memory access. To avoid any such logic errors causing out of bounds memory accesses, this commit factors out all accesses to the per-host bulk flow counters to a series of helpers that perform bounds-checking before any increments and decrements. This also has the benefit of improving readability by moving the conditional checks for the flow mode into these helpers, instead of having them spread out throughout the code (which was the cause of the original logic error). As part of this change, the flow quantum calculation is consolidated into a helper function, which means that the dithering applied to the ost load scaling is now applied both in the DRR rotation and when a sparse flow's quantum is first initiated. The only user-visible effect of this is that the maximum packet size that can be sent while a flow stays sparse will now vary with +/- one byte in some cases. This should not make a noticeable difference in practice, and thus it's not worth complicating the code to preserve the old behaviour.
Weaknesses (CWE)
- CWE-125 — Out-of-bounds Read
References
- https://git.kernel.org/stable/c/44fe1efb4961c1a5ccab16bb579dfc6b308ad58b
- https://git.kernel.org/stable/c/b1a1743aaa4906c41c426eda97e2e2586f79246d
- https://git.kernel.org/stable/c/bb0245fa72b783cb23a9949c5048781341e91423
- https://git.kernel.org/stable/c/a777e06dfc72bed73c05dcb437d7c27ad5f90f3f
- https://git.kernel.org/stable/c/27202e2e8721c3b23831563c36ed5ac7818641ba
- https://git.kernel.org/stable/c/91bb18950b88f955838ec0c1d97f74d135756dc7
- https://git.kernel.org/stable/c/737d4d91d35b5f7fa5bb442651472277318b0bfd
- https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html
- https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html
- https://cert-portal.siemens.com/productcert/html/ssa-265688.html
- https://cert-portal.siemens.com/productcert/html/ssa-503939.html
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.3 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H | Linux |
| CVSS 3.1 | HIGH 7.3 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H | NVD · 416baaa9-dc9f-4396-8d5f-8c081fb06d67 (Secondary) |
| CVSS 3.1 | HIGH 7.1 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2025-2596
- GCVE · GCVE-0-2025-21647
CERT-FR advisories
- CERTFR-2026-AVI-0168 — Multiples vulnérabilités dans le noyau Linux de Red Hat · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0106 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2025-AVI-1057 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0605 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0559 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0463 — Multiples vulnérabilités dans le noyau Linux de Debian LTS · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0254 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0234 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0212 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0184 — Multiples vulnérabilités dans le noyau Linux de Debian LTS · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0183 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0134 — Multiples vulnérabilités dans le noyau Linux de Debian · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.4.284 < 5.4.291cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.10.226 < 5.10.235cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.15.167 < 5.15.179cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.1.110 < 6.1.125cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.6.51 < 6.6.72cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.10.10 < 6.11cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.11.1 < 6.12.10cpe:2.3:o:linux:linux_kernel:6.11:-:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:6.11:rc7:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:6.13:rc1:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:6.13:rc2:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:6.13:rc3:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:6.13:rc4:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:6.13:rc5:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:6.13:rc6:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| Linux · Linux | affected 4a4eeefa514db570be025ab46d779af180e2c9bb < 44fe1efb4961c1a5ccab16bb579dfc6b308ad58b ; affected 7725152b54d295b7da5e34c2f419539b30d017bd < b1a1743aaa4906c41c426eda97e2e2586f79246d ; affected cde71a5677971f4f1b69b25e854891dbe78066a4 < bb0245fa72b783cb23a9949c5048781341e91423 ; affected 549e407569e08459d16122341d332cb508024094 < a777e06dfc72bed73c05dcb437d7c27ad5f90f3f ; affected d4a9039a7b3d8005b90c7b1a55a306444f0e5447 < 27202e2e8721c3b23831563c36ed5ac7818641ba ; affected 546ea84d07e3e324644025e2aae2d12ea4c5896e < 91bb18950b88f955838ec0c1d97f74d135756dc7 |
| Linux · Linux | affected 6.11 ; unaffected 0 < 6.11 ; unaffected 5.4.291 ≤ 5.4.* ; unaffected 5.10.235 ≤ 5.10.* ; unaffected 5.15.179 ≤ 5.15.* ; unaffected 6.1.125 ≤ 6.1.* |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |