CVE-2025-21647

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: sched: sch_cake: add bounds checks to host bulk flow fairness counts Even though we fixed a logic error in the commit cited below, syzbot still managed to trigger an underflow of the per-host bulk flow counters, leading to an out of bounds memory access. To avoid any such logic errors causing out of bounds memory accesses, this commit factors out all accesses to the per-host bulk flow counters to a series of helpers that perform bounds-checking before any increments and decrements. This also has the benefit of improving rea...

Affected product and versions

Product

Linux Linux, SIMATIC S7-1500 TM MFP - BIOS, SIMATIC S7-1500 TM MFP - GNU/Linux subsystem

Affected versions

>= 4a4eeefa514db570be025ab46d779af180e2c9bb < 44fe1efb4961c1a5ccab16bb579dfc6b308ad58b, >= 7725152b54d295b7da5e34c2f419539b30d017bd < b1a1743aaa4906c41c426eda97e2e2586f79246d, >= cde71a5677971f4f1b69b25e854891dbe78066a4 < bb0245fa72b783cb23a9949c5048781341e91423, >= 549e407569e08459d16122341d332cb508024094 < a777e06dfc72bed73c05dcb437d7c27ad5f90f3f, >= d4a9039a7b3d8005b90c7b1a55a306444f0e5447 < 27202e2e8721c3b23831563c36ed5ac7818641ba, >= 546ea84d07e3e324644025e2aae2d12ea4c5896e < 91bb18950b88f955838ec0c1d97f74d135756dc7, >= 546ea84d07e3e324644025e2aae2d12ea4c5896e < 737d4d91d35b5f7fa5bb442651472277318b0bfd, >= d7c01c0714c04431b5e18cf17a9ea68a553d1c3c, >= 5.4.284 < 5.4.291, >= 5.10.226 < 5.10.235, >= 5.15.167 < 5.15.179, >= 6.1.110 < 6.1.125, >= 6.6.51 < 6.6.72, >= 6.10.10 < 6.11, >= 6.11, >= 6.11.1 < 6.12.10, 6.11, 6.13

Fixed versions

5.4.291, 5.10.235, 5.15.179, 6.1.125, 6.6.72, 6.11, 6.12.10

Technical data

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

CWE

CWE-125