Executive brief
A vulnerability in the Linux kernel's networking subsystem could allow a local user to cause a system crash or potentially execute unauthorized code. The issue exists in the way the system handles traffic priority settings, where a specific input value can overwrite memory outside of its intended area. This could lead to a total loss of system confidentiality, integrity, and availability.
Technical details
An out-of-bounds (OOB) write vulnerability exists in the Linux kernel's net/sched/sch_mqprio.c component during the parsing of traffic control (tc) entries. The root cause is an off-by-one error in the validation policy for TCA_MQPRIO_TC_ENTRY_INDEX, which uses NLA_POLICY_MAX with TC_QOPT_MAX_QUEUE (16). Because the destination array fp[] only has 16 elements (indexed 0-15), providing an index of 16 results in a 4-byte OOB write on the stack. A local attacker with low privileges can exploit this to corrupt kernel memory, potentially leading to privilege escalation or a kernel panic. Patches have been released for multiple stable kernel branches to adjust the policy to TC_QOPT_MAX_QUEUE - 1.
Affected products
- Linux Linux Kernel 6.4 through 6.6.101, 6.7 through 6.12.41, 6.13 through 6.15.9, 6.16 through 6.16.0
Timeline
- 2025-08-01: other: Fix authored
- 2025-08-19: disclosed: CVE published
- 2025-08-15: patched: Fix committed to stable branches
References
- https://git.kernel.org/stable/c/39491e859fd494d0b51adc5c7d54c8a7dcf1d198
- https://git.kernel.org/stable/c/66fc2ebdd9d5dd6e5a9c7edeace5a61a0ab2cd86
- https://git.kernel.org/stable/c/d00e4125680f7074c4f42ce3c297336f23128e70
- https://git.kernel.org/stable/c/f1a9dbcb7d17bf0abb325cdc984957cfabc59693
- https://git.kernel.org/stable/c/ffd2dc4c6c49ff4f1e5d34e454a6a55608104c17