CVE-2025-38568
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2025-38568
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-38568.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2025-38568
- Downstream
- Related
- Published
- 2025-08-19T17:02:49.278Z
- Modified
- 2025-11-27T19:35:06.408977Z
- Summary
- net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing
TCAMQPRIOTCENTRYINDEX is validated using NLAPOLICYMAX(NLAU32, TCQOPTMAXQUEUE), which allows the value TCQOPTMAX_QUEUE (16). This leads to a 4-byte out-of-bounds stack write in the fp[] array, which only has room for 16 elements (0–15).
Fix this by changing the policy to allow only up to TCQOPTMAX_QUEUE - 1.
- Database specific
{ "cna_assigner": "Linux", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/blob/ee626f5d79d5817bb21d6f048dc0da4c4e383443/cves/2025/38xxx/CVE-2025-38568.json" }- References
-
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- https://git.kernel.org/stable/c/39491e859fd494d0b51adc5c7d54c8a7dcf1d198
- https://git.kernel.org/stable/c/66fc2ebdd9d5dd6e5a9c7edeace5a61a0ab2cd86
- https://git.kernel.org/stable/c/d00e4125680f7074c4f42ce3c297336f23128e70
- https://git.kernel.org/stable/c/f1a9dbcb7d17bf0abb325cdc984957cfabc59693
- https://git.kernel.org/stable/c/ffd2dc4c6c49ff4f1e5d34e454a6a55608104c17
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedf62af20bed2d9e824f51cfc97ff01bc261f40e58Fixed39491e859fd494d0b51adc5c7d54c8a7dcf1d198
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedf62af20bed2d9e824f51cfc97ff01bc261f40e58Fixedd00e4125680f7074c4f42ce3c297336f23128e70
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedf62af20bed2d9e824f51cfc97ff01bc261f40e58Fixed66fc2ebdd9d5dd6e5a9c7edeace5a61a0ab2cd86
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedf62af20bed2d9e824f51cfc97ff01bc261f40e58Fixedf1a9dbcb7d17bf0abb325cdc984957cfabc59693
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedf62af20bed2d9e824f51cfc97ff01bc261f40e58Fixedffd2dc4c6c49ff4f1e5d34e454a6a55608104c17