Skip to content
CVE PROGRAM SOURCE RECORD7.3 High

CVE-2025-21647

sched: sch_cake: add bounds checks to host bulk flow fairness counts

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: sched: sch_cake: add bounds checks to host bulk flow fairness counts Even though we fixed a logic error in the commit cited below, syzbot still managed to trigger an underflow of the per-host bulk flow counters, leading to an out of bounds memory access. To avoid any such logic errors causing out of bounds memory accesses, this commit factors out all accesses to the per-host bulk flow counters to a series of helpers that perform bounds-checking before any increments and decrements. This also has the benefit of improving readability by moving the conditional checks for the flow mode into these helpers, instead of having them spread out throughout the code (which was the cause of the original logic error). As part of this change, the flow quantum calculation is consolidated into a helper function, which means that the dithering applied to the ost load scaling is now applied both in the DRR rotation and when a sparse flow's quantum is first initiated. The only user-visible effect of this is that the maximum packet size that can be sent while a flow stays sparse will now vary with +/- one byte in some cases. This should not make a noticeable difference in practice, and thus it's not worth complicating the code to preserve the old behaviour.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 4a4eeefa514db570be025ab46d779af180e2c9bb to < 44fe1efb4961c1a5ccab16bb579dfc6b308ad58baffected
  • 7725152b54d295b7da5e34c2f419539b30d017bd to < b1a1743aaa4906c41c426eda97e2e2586f79246daffected
  • cde71a5677971f4f1b69b25e854891dbe78066a4 to < bb0245fa72b783cb23a9949c5048781341e91423affected
  • 549e407569e08459d16122341d332cb508024094 to < a777e06dfc72bed73c05dcb437d7c27ad5f90f3faffected
  • d4a9039a7b3d8005b90c7b1a55a306444f0e5447 to < 27202e2e8721c3b23831563c36ed5ac7818641baaffected
  • 546ea84d07e3e324644025e2aae2d12ea4c5896e to < 91bb18950b88f955838ec0c1d97f74d135756dc7affected
  • 546ea84d07e3e324644025e2aae2d12ea4c5896e to < 737d4d91d35b5f7fa5bb442651472277318b0bfdaffected
  • d7c01c0714c04431b5e18cf17a9ea68a553d1c3caffected
  • 5.4.284 to < 5.4.291affected
  • 5.10.226 to < 5.10.235affected
  • 5.15.167 to < 5.15.179affected
  • 6.1.110 to < 6.1.125affected
  • 6.6.51 to < 6.6.72affected
  • 6.10.10 to < 6.11affected

Linux Linux

Default version status: affected

  • 6.11affected
  • 0 to < 6.11unaffected
  • 5.4.291 to ≤ 5.4.*unaffected
  • 5.10.235 to ≤ 5.10.*unaffected
  • 5.15.179 to ≤ 5.15.*unaffected
  • 6.1.125 to ≤ 6.1.*unaffected
  • 6.6.72 to ≤ 6.6.*unaffected
  • 6.12.10 to ≤ 6.12.*unaffected
  • 6.13 to ≤ *unaffected

References