CVE-2025-38568

net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing

published August 19, 2025

CVSS
—
EPSS
0%
Percentile
6.8
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing

TCA_MQPRIO_TC_ENTRY_INDEX is validated using

NLA_POLICY_MAX(NLA_U32, TC_QOPT_MAX_QUEUE), which allows the value

TC_QOPT_MAX_QUEUE (16). This leads to a 4-byte out-of-bounds stack

write in the fp[] array, which only has room for 16 elements (0–15).

Fix this by changing the policy to allow only up to TC_QOPT_MAX_QUEUE - 1.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00176 · 6.8th percentile
Published
2025-08-19T17:02Z
EPSS history
Timeline
  • 19 AUG 17:02Z
    net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing
    cvelistv5