Skip to content
Fencer Vulns
high 7.8

CVE-2025-37752 json

net_sched: sch_sfq: move the limit validation

published 2025-05-01 18 mo ago modified 2026-08-05 3 mo ago also EUVD-2025-13064

cvss
7.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 23%
public exploits
0
none known

Summary

In the Linux kernel, the following vulnerability has been resolved:

net_sched: sch_sfq: move the limit validation

It is not sufficient to directly validate the limit on the data that the user passes as it can be updated based on how the other parameters are changed.

Move the check at the end of the configuration update process to also catch scenarios where the limit is indirectly updated, for example with the following configurations:

tc qdisc add dev dummy0 handle 1: root sfq limit 2 flows 1 depth 1 tc qdisc add dev dummy0 handle 1: root sfq limit 2 flows 1 divisor 1

This fixes the following syzkaller reported crash:

------------[ cut here ]------------ UBSAN: array-index-out-of-bounds in net/sched/sch_sfq.c:203:6 index 65535 is out of range for type 'struct sfq_head[128]' CPU: 1 UID: 0 PID: 3037 Comm: syz.2.16 Not tainted 6.14.0-rc2-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x201/0x300 lib/dump_stack.c:120 ubsan_epilogue lib/ubsan.c:231 [inline] __ubsan_handle_out_of_bounds+0xf5/0x120 lib/ubsan.c:429 sfq_link net/sched/sch_sfq.c:203 [inline] sfq_dec+0x53c/0x610 net/sched/sch_sfq.c:231 sfq_dequeue+0x34e/0x8c0 net/sched/sch_sfq.c:493 sfq_reset+0x17/0x60 net/sched/sch_sfq.c:518 qdisc_reset+0x12e/0x600 net/sched/sch_generic.c:1035 tbf_reset+0x41/0x110 net/sched/sch_tbf.c:339 qdisc_reset+0x12e/0x600 net/sched/sch_generic.c:1035 dev_reset_queue+0x100/0x1b0 net/sched/sch_generic.c:1311 netdev_for_each_tx_queue include/linux/netdevice.h:2590 [inline] dev_deactivate_many+0x7e5/0xe70 net/sched/sch_generic.c:1375

Patch / fix

  • Linux Linux 6.1.135, 6.6.88, 6.12.24, 6.13.12, 6.14.3, 6.15
  • linux Debian 12 6.1.135-1
  • linux Debian 14, Debian 13 6.12.25-1

debian advisories DEBIAN-CVE-2025-37752

  • linux Ubuntu 24.04 LTS 6.8.0-79.79
  • linux-aws Ubuntu 24.04 LTS 6.8.0-1036.38
  • linux-gcp Ubuntu 24.04 LTS 6.8.0-1037.39
  • linux-gke Ubuntu 24.04 LTS 6.8.0-1033.37
  • linux-ibm Ubuntu 24.04 LTS 6.8.0-1036.36
  • linux-azure Ubuntu 24.04 LTS 6.8.0-1038.44
  • linux-gkeop Ubuntu 24.04 LTS 6.8.0-1020.22
  • linux-raspi Ubuntu 24.04 LTS 6.8.0-1036.40

ubuntu advisories UBUNTU-CVE-2025-37752

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • kernel-livepatch-MICRO-6-0-RT_Update_3 Linux Micro 6.0 9-1.2
  • kernel-livepatch-MICRO-6-0-RT_Update_4 Linux Micro 6.1, Linux Micro 6.0 6-1.1
  • kernel-livepatch-MICRO-6-0-RT_Update_5 Linux Micro 6.1, Linux Micro 6.0 5-1.1
  • kernel-livepatch-MICRO-6-0-RT_Update_6 Linux Micro 6.1, Linux Micro 6.0 3-3.1
  • kernel-livepatch-MICRO-6-0-RT_Update_7 Linux Micro 6.1, Linux Micro 6.0 3-1.3
  • kernel-livepatch-MICRO-6-0-RT_Update_8 Linux Micro 6.1, Linux Micro 6.0 2-1.2
  • kernel-livepatch-MICRO-6-0-RT_Update_2 Linux Micro 6.1, Linux Micro 6.0 9-1.1
  • kernel-livepatch-MICRO-6-0_Update_6 Linux Micro 6.1, Linux Micro 6.0 3-3.1

suse advisories SUSE-SU-2025:4123-1SUSE-SU-2025:20578-1SUSE-SU-2025:20579-1SUSE-SU-2025:20580-1SUSE-SU-2025:20581-1SUSE-SU-2025:20582-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-37752 updated cvss 6.3

kernel: net_sched: sch_sfq: move the limit validation

  • Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +1 more Red Hat Enterprise Linux 7 perf, kernel, bpftool, kernel-rt, python-perf, kernel-kdump, +8 more
    affected: no fix planned “Out of support scope”
  • Red Hat Enterprise Linux 8 perf, kernel, bpftool, kernel-rt, kernel-core, kernel-tools, +29 more Red Hat Enterprise Linux 9 rv, perf, rtla, kernel, bpftool, libperf, +83 more Red Hat Enterprise Linux 10 kernel
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

0.30% chance of exploitation in the next 30 days, higher than 23% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

  • Linux Linux

Classification

Weakness
  • CWE-129 Improper Validation of Array Index
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.