Vigie VulnDBEuropean-hosted Vulnerability DB
EN
Menu

sched/fair: Fix potential memory corruption in child_cfs_rq_on_list (Linux Linux)

CVE-2025-21919
HIGH 7.8

En bref

Source
NVD
EPSS
EPSS 0.24 % · centile 15 ()
État
PUBLISHED
Publiée
Mise à jour
Attribuée par
Linux
Statut NVD
Modified

Rechercher sur…

Description

In the Linux kernel, the following vulnerability has been resolved: sched/fair: Fix potential memory corruption in child_cfs_rq_on_list child_cfs_rq_on_list attempts to convert a 'prev' pointer to a cfs_rq. This 'prev' pointer can originate from struct rq's leaf_cfs_rq_list, making the conversion invalid and potentially leading to memory corruption. Depending on the relative positions of leaf_cfs_rq_list and the task group (tg) pointer within the struct, this can cause a memory fault or access garbage data. The issue arises in list_add_leaf_cfs_rq, where both cfs_rq->leaf_cfs_rq_list and rq->leaf_cfs_rq_list are added to the same leaf list. Also, rq->tmp_alone_branch can be set to rq->leaf_cfs_rq_list. This adds a check `if (prev == &rq->leaf_cfs_rq_list)` after the main conditional in child_cfs_rq_on_list. This ensures that the container_of operation will convert a correct cfs_rq struct. This check is sufficient because only cfs_rqs on the same CPU are added to the list, so verifying the 'prev' pointer against the current rq's list head is enough. Fixes a potential memory corruption issue that due to current struct layout might not be manifesting as a crash but could lead to unpredictable behavior when the layout changes.

Faiblesses (CWE)

Références

Scores

VersionScoreVecteurÉvalué par
CVSS 3.1HIGH 7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HLinux
CVSS 3.1HIGH 7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HCISA-ADP
CVSS 3.1HIGH 7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HNVD · 416baaa9-dc9f-4396-8d5f-8c081fb06d67 (Secondary)
CVSS 3.1HIGH 7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HNVD · nvd@nist.gov (Primary)
CVSS 3.1HIGH 7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HNVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Références européennes

Avis du CERT-FR

Configurations affectées (CPE NVD)

Produits affectés

ProduitVersions
Linux · Linuxaffected fdaba61ef8a268d4136d0a113d153f7a89eb9984 < 5cb300dcdd27e6a351ac02541e0231261c775852 ; affected fdaba61ef8a268d4136d0a113d153f7a89eb9984 < 000c9ee43928f2ce68a156dd40bab7616256f4dd ; affected fdaba61ef8a268d4136d0a113d153f7a89eb9984 < 9cc7f0018609f75a349e42e3aebc3b0e905ba775 ; affected fdaba61ef8a268d4136d0a113d153f7a89eb9984 < b5741e4b9ef3567613b2351384f91d3f16e59986 ; affected fdaba61ef8a268d4136d0a113d153f7a89eb9984 < e1dd09df30ba86716cb2ffab97dc35195c01eb8f ; affected fdaba61ef8a268d4136d0a113d153f7a89eb9984 < 3b4035ddbfc8e4521f85569998a7569668cccf51
Linux · Linuxaffected 5.13 ; unaffected 0 < 5.13 ; unaffected 5.15.179 ≤ 5.15.* ; unaffected 6.1.131 ≤ 6.1.* ; unaffected 6.6.83 ≤ 6.6.* ; unaffected 6.12.19 ≤ 6.12.*

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD