In the Linux kernel, the following vulnerability has been resolved:
netsched: clsflow: validate TCAFLOWRSHIFT attribute
syzbot found that TCAFLOWRSHIFT attribute was not validated. Right shitfing a 32bit integer is undefined for large shift values.
UBSAN: shift-out-of-bounds in net/sched/clsflow.c:329:23 shift exponent 9445 is too large for 32-bit type 'u32' (aka 'unsigned int') CPU: 1 UID: 0 PID: 54 Comm: kworker/u8:3 Not tainted 6.13.0-rc3-syzkaller-00180-g4f619d518db9 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Workqueue: ipv6addrconf addrconfdadwork Call Trace: <TASK> _dumpstack lib/dumpstack.c:94 [inline] dumpstacklvl+0x241/0x360 lib/dumpstack.c:120 ubsanepilogue lib/ubsan.c:231 [inline] _ubsanhandleshiftoutofbounds+0x3c8/0x420 lib/ubsan.c:468 flowclassify+0x24d5/0x25b0 net/sched/clsflow.c:329 tcclassify include/net/tcwrapper.h:197 [inline] _tcfclassify net/sched/clsapi.c:1771 [inline] tcfclassify+0x420/0x1160 net/sched/clsapi.c:1867 sfbclassify net/sched/schsfb.c:260 [inline] sfbenqueue+0x3ad/0x18b0 net/sched/schsfb.c:318 devqdiscenqueue+0x4b/0x290 net/core/dev.c:3793 _devxmitskb net/core/dev.c:3889 [inline] _devqueuexmit+0xf0e/0x3f50 net/core/dev.c:4400 devqueuexmit include/linux/netdevice.h:3168 [inline] neighhhoutput include/net/neighbour.h:523 [inline] neighoutput include/net/neighbour.h:537 [inline] ipfinishoutput2+0xd41/0x1390 net/ipv4/ipoutput.c:236 iptunnelxmit+0x55d/0x9b0 net/ipv4/iptunnelcore.c:82 udptunnelxmitskb+0x262/0x3b0 net/ipv4/udptunnelcore.c:173 genevexmitskb drivers/net/geneve.c:916 [inline] genevexmit+0x21dc/0x2d00 drivers/net/geneve.c:1039 _netdevstartxmit include/linux/netdevice.h:5002 [inline] netdevstartxmit include/linux/netdevice.h:5011 [inline] xmitone net/core/dev.c:3590 [inline] devhardstartxmit+0x27a/0x7d0 net/core/dev.c:3606 _devqueue_xmit+0x1b73/0x3f50 net/core/dev.c:4434
[
    {
        "id": "CVE-2025-21653-350087d3",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "target": {
            "file": "net/sched/cls_flow.c"
        },
        "digest": {
            "line_hashes": [
                "303407285229887043411826358162164023140",
                "183155151567545280910573749658192074112",
                "88497169893277187302522513507393844681",
                "95256103093042046686506412703632227913"
            ],
            "threshold": 0.9
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6fde663f7321418996645ee602a473457640542f"
    },
    {
        "id": "CVE-2025-21653-3a3e9968",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "target": {
            "file": "net/sched/cls_flow.c"
        },
        "digest": {
            "line_hashes": [
                "303407285229887043411826358162164023140",
                "183155151567545280910573749658192074112",
                "88497169893277187302522513507393844681",
                "95256103093042046686506412703632227913"
            ],
            "threshold": 0.9
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2011749ca96460386844dfc7e0fde53ebee96f3c"
    },
    {
        "id": "CVE-2025-21653-459729fc",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "target": {
            "file": "net/sched/cls_flow.c"
        },
        "digest": {
            "line_hashes": [
                "303407285229887043411826358162164023140",
                "183155151567545280910573749658192074112",
                "88497169893277187302522513507393844681",
                "95256103093042046686506412703632227913"
            ],
            "threshold": 0.9
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@43658e4a5f2770ad94e93362885ff51c10cf3179"
    },
    {
        "id": "CVE-2025-21653-695e77b0",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "target": {
            "file": "net/sched/cls_flow.c"
        },
        "digest": {
            "line_hashes": [
                "303407285229887043411826358162164023140",
                "183155151567545280910573749658192074112",
                "88497169893277187302522513507393844681",
                "95256103093042046686506412703632227913"
            ],
            "threshold": 0.9
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e54beb9aed2a90dddf4c5d68fcfc9a01f3e40a61"
    },
    {
        "id": "CVE-2025-21653-7ea05747",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "target": {
            "file": "net/sched/cls_flow.c"
        },
        "digest": {
            "line_hashes": [
                "303407285229887043411826358162164023140",
                "183155151567545280910573749658192074112",
                "88497169893277187302522513507393844681",
                "95256103093042046686506412703632227913"
            ],
            "threshold": 0.9
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a039e54397c6a75b713b9ce7894a62e06956aa92"
    },
    {
        "id": "CVE-2025-21653-c72367d4",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "target": {
            "file": "net/sched/cls_flow.c"
        },
        "digest": {
            "line_hashes": [
                "303407285229887043411826358162164023140",
                "183155151567545280910573749658192074112",
                "88497169893277187302522513507393844681",
                "95256103093042046686506412703632227913"
            ],
            "threshold": 0.9
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a313d6e6d5f3a631cae5a241c392c28868aa5c5e"
    },
    {
        "id": "CVE-2025-21653-f0c32e42",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "target": {
            "file": "net/sched/cls_flow.c"
        },
        "digest": {
            "line_hashes": [
                "303407285229887043411826358162164023140",
                "183155151567545280910573749658192074112",
                "88497169893277187302522513507393844681",
                "95256103093042046686506412703632227913"
            ],
            "threshold": 0.9
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9858f4afeb2e59506e714176bd3e135539a3eeec"
    }
]