High · published April 28, 2023
qfq_change_class in net/sched/sch_qfq.c in the Linux kernel before 6.2.13 allows an out-of-bounds write because lmax can exceed QFQ_MIN_LMAX.
| Product | Versions | Fixed in |
|---|---|---|
| linux/linux_kernel | ≥ 3.7, < 4.14.314 | 4.14.314 |
| linux/linux_kernel | ≥ 4.15, < 4.19.282 | 4.19.282 |
| linux/linux_kernel | ≥ 4.20, < 5.4.242 | 5.4.242 |
| linux/linux_kernel | ≥ 5.5.0, < 5.10.179 | 5.10.179 |
| linux/linux_kernel | ≥ 5.11, < 5.15.109 | 5.15.109 |
| linux/linux_kernel | ≥ 5.16, < 6.1.26 | 6.1.26 |
| linux/linux_kernel | ≥ 6.2, < 6.2.13 | 6.2.13 |