CVE-2025-21653: net_sched: cls_flow: validate TCA_FLOW_RSHIFT attribute

Published Jan 19, 2025
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

netsched: clsflow: validate TCAFLOWRSHIFT attribute

syzbot found that TCAFLOWRSHIFT attribute was not validated. Right shitfing a 32bit integer is undefined for large shift values.

UBSAN: shift-out-of-bounds in net/sched/clsflow.c:329:23 shift exponent 9445 is too large for 32-bit type 'u32' (aka 'unsigned int') CPU: 1 UID: 0 PID: 54 Comm: kworker/u8:3 Not tainted 6.13.0-rc3-syzkaller-00180-g4f619d518db9 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Workqueue: ipv6addrconf addrconfdadwork Call Trace: <TASK> dumpstack lib/dumpstack.c:94 [inline] dumpstacklvl+0x241/0x360 lib/dumpstack.c:120 ubsanepilogue lib/ubsan.c:231 [inline] ubsanhandleshiftoutofbounds+0x3c8/0x420 lib/ubsan.c:468 flowclassify+0x24d5/0x25b0 net/sched/clsflow.c:329 tcclassify include/net/tcwrapper.h:197 [inline] tcfclassify net/sched/clsapi.c:1771 [inline] tcfclassify+0x420/0x1160 net/sched/clsapi.c:1867 sfbclassify net/sched/schsfb.c:260 [inline] sfbenqueue+0x3ad/0x18b0 net/sched/schsfb.c:318 devqdiscenqueue+0x4b/0x290 net/core/dev.c:3793 devxmitskb net/core/dev.c:3889 [inline] devqueuexmit+0xf0e/0x3f50 net/core/dev.c:4400 devqueuexmit include/linux/netdevice.h:3168 [inline] neighhhoutput include/net/neighbour.h:523 [inline] neighoutput include/net/neighbour.h:537 [inline] ipfinishoutput2+0xd41/0x1390 net/ipv4/ipoutput.c:236 iptunnelxmit+0x55d/0x9b0 net/ipv4/iptunnelcore.c:82 udptunnelxmitskb+0x262/0x3b0 net/ipv4/udptunnelcore.c:173 genevexmitskb drivers/net/geneve.c:916 [inline] genevexmit+0x21dc/0x2d00 drivers/net/geneve.c:1039 netdevstartxmit include/linux/netdevice.h:5002 [inline] netdevstartxmit include/linux/netdevice.h:5011 [inline] xmitone net/core/dev.c:3590 [inline] devhardstartxmit+0x27a/0x7d0 net/core/dev.c:3606 devqueuexmit+0x1b73/0x3f50 net/core/dev.c:4434

Other sources

This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.

— Launchpad

Affected Software

219 affected componentsFixes available
Linux Linux kernel
Linux Linux kernel>=2.6.25<5.4.290
Linux Linux kernel>=5.5<5.10.234
Linux Linux kernel>=5.11<5.15.177
Linux Linux kernel>=5.16<6.1.125
Linux Linux kernel>=6.2<6.6.72
Linux Linux kernel>=6.7<6.12.10
Linux Linux kernel=6.13-rc1
Linux Linux kernel=6.13-rc2
Linux Linux kernel=6.13-rc3
Linux Linux kernel=6.13-rc4
Linux Linux kernel=6.13-rc5
Linux Linux kernel=6.13-rc6
ubuntu/linux*
ubuntu/linux-aws*
ubuntu/linux-azure*
ubuntu/linux-lts-xenial*
ubuntu/linux*
ubuntu/linux-aws*
ubuntu/linux-aws-hwe*
ubuntu/linux-azure*
ubuntu/linux-gcp*
ubuntu/linux-hwe*
ubuntu/linux-hwe-edge*
ubuntu/linux-kvm*
ubuntu/linux-oracle*
ubuntu/linux-fips*
ubuntu/linux-fips*
ubuntu/linux*
ubuntu/linux-aws*
ubuntu/linux-aws-5.0*
ubuntu/linux-aws-5.3*
ubuntu/linux-aws-5.4<5.4.0-1142.152~18.04.1
5.4.0-1142.152~18.04.1
ubuntu/linux-azure*
ubuntu/linux-azure-4.15*
ubuntu/linux-azure-5.3*
ubuntu/linux-azure-5.4<5.4.0-1147.154~18.04.1
5.4.0-1147.154~18.04.1
ubuntu/linux-azure-edge*
ubuntu/linux-gcp*
ubuntu/linux-gcp-4.15*
ubuntu/linux-gcp-5.3*
ubuntu/linux-gcp-5.4<5.4.0-1145.154~18.04.1
5.4.0-1145.154~18.04.1
ubuntu/linux-gke-4.15*
ubuntu/linux-gke-5.4*
ubuntu/linux-gkeop-5.4*
ubuntu/linux-hwe*
ubuntu/linux-hwe-5.4<5.4.0-211.231~18.04.1
5.4.0-211.231~18.04.1
ubuntu/linux-hwe-edge*
ubuntu/linux-ibm-5.4<5.4.0-1090.95~18.04.1
5.4.0-1090.95~18.04.1
ubuntu/linux-kvm*
ubuntu/linux-oem*
ubuntu/linux-oracle*
ubuntu/linux-oracle-5.0*
ubuntu/linux-oracle-5.3*
ubuntu/linux-oracle-5.4<5.4.0-1140.149~18.04.1
5.4.0-1140.149~18.04.1
ubuntu/linux-raspi-5.4<5.4.0-1129.142~18.04.1
5.4.0-1129.142~18.04.1
ubuntu/linux-aws-fips*
ubuntu/linux-azure-fips*
ubuntu/linux-fips*
ubuntu/linux-gcp-fips*
ubuntu/linux-aws-fips*
ubuntu/linux-azure-fips*
ubuntu/linux-fips*
ubuntu/linux-gcp-fips*
ubuntu/linux<5.4.0-211.231
5.4.0-211.231
ubuntu/linux-aws<5.4.0-1142.152
5.4.0-1142.152
ubuntu/linux-aws-5.15<5.15.0-1080.87~20.04.1
5.15.0-1080.87~20.04.1
ubuntu/linux-azure<5.4.0-1147.154
5.4.0-1147.154
ubuntu/linux-azure-5.15<5.15.0-1086.95~20.04.1
5.15.0-1086.95~20.04.1
ubuntu/linux-bluefield<5.4.0-1101.108
5.4.0-1101.108
ubuntu/linux-gcp<5.4.0-1145.154
5.4.0-1145.154
ubuntu/linux-gcp-5.15<5.15.0-1081.90~20.04.1
5.15.0-1081.90~20.04.1
ubuntu/linux-hwe-5.15<5.15.0-136.147~20.04.1
5.15.0-136.147~20.04.1
ubuntu/linux-ibm<5.4.0-1088.93
5.4.0-1088.93
ubuntu/linux-ibm-5.15<5.15.0-1074.77~20.04.1
5.15.0-1074.77~20.04.1
ubuntu/linux-intel-iotg-5.15<5.15.0-1077.83~20.04.1
5.15.0-1077.83~20.04.1
ubuntu/linux-iot<5.4.0-1048.51
5.4.0-1048.51
ubuntu/linux-kvm<5.4.0-1129.138
5.4.0-1129.138
ubuntu/linux-lowlatency-hwe-5.15<5.15.0-135.146~20.04.1
5.15.0-135.146~20.04.1
ubuntu/linux-oracle<5.4.0-1140.150
5.4.0-1140.150
ubuntu/linux-oracle-5.15<5.15.0-1077.83~20.04.1
5.15.0-1077.83~20.04.1
ubuntu/linux-raspi<5.4.0-1129.142
5.4.0-1129.142
ubuntu/linux-riscv-5.15<5.15.0-1075.79~20.04.1
5.15.0-1075.79~20.04.1
ubuntu/linux-xilinx-zynqmp<5.4.0-1060.64
5.4.0-1060.64
ubuntu/linux-aws-5.11*
ubuntu/linux-aws-5.13*
ubuntu/linux-aws-5.8*
ubuntu/linux-azure-5.11*
ubuntu/linux-azure-5.13*
ubuntu/linux-azure-5.8*
ubuntu/linux-azure-fde*
ubuntu/linux-gcp-5.11*
ubuntu/linux-gcp-5.13*
ubuntu/linux-gcp-5.8*
ubuntu/linux-gke*
ubuntu/linux-gke-5.15*
ubuntu/linux-gkeop*
ubuntu/linux-gkeop-5.15*
ubuntu/linux-hwe-5.11*
ubuntu/linux-hwe-5.13*
ubuntu/linux-hwe-5.8*
ubuntu/linux-intel-5.13*
ubuntu/linux-nvidia-tegra-5.15<5.15.0-1039.39~20.04.1
5.15.0-1039.39~20.04.1
ubuntu/linux-oem-5.10*
ubuntu/linux-oem-5.13*
ubuntu/linux-oem-5.6*
ubuntu/linux-oracle-5.11*
ubuntu/linux-oracle-5.13*
ubuntu/linux-oracle-5.8*
ubuntu/linux-raspi2*
ubuntu/linux-riscv*
ubuntu/linux-riscv-5.11*
ubuntu/linux-riscv-5.8*
ubuntu/linux-aws-fips<5.4.0-1142.153+fips1
5.4.0-1142.153+fips1
ubuntu/linux-azure-fips<5.4.0-1147.154+fips1
5.4.0-1147.154+fips1
ubuntu/linux-fips<5.4.0-1116.126
5.4.0-1116.126
ubuntu/linux-gcp-fips<5.4.0-1145.154+fips1
5.4.0-1145.154+fips1
ubuntu/linux-aws-fips*
ubuntu/linux-azure-fips*
ubuntu/linux-fips*
ubuntu/linux-gcp-fips*
ubuntu/linux<5.15.0-135.146
5.15.0-135.146
ubuntu/linux-allwinner-5.19*
ubuntu/linux-aws<5.15.0-1080.87
5.15.0-1080.87
ubuntu/linux-aws-5.19*
ubuntu/linux-aws-6.2*
ubuntu/linux-aws-6.5*
ubuntu/linux-aws-6.8<6.8.0-1029.31~22.04.1
6.8.0-1029.31~22.04.1
ubuntu/linux-azure<5.15.0-1084.93
5.15.0-1084.93
ubuntu/linux-azure-5.19*
ubuntu/linux-azure-6.2*
ubuntu/linux-azure-6.5*
ubuntu/linux-azure-6.8<6.8.0-1029.34~22.04.1
6.8.0-1029.34~22.04.1
ubuntu/linux-azure-fde<5.15.0-1084.93.1
5.15.0-1084.93.1
ubuntu/linux-azure-fde-5.19*
ubuntu/linux-azure-fde-6.2*
ubuntu/linux-gcp<5.15.0-1079.88
5.15.0-1079.88
ubuntu/linux-gcp-5.19*
ubuntu/linux-gcp-6.2*
ubuntu/linux-gcp-6.5*
ubuntu/linux-gcp-6.8<6.8.0-1030.32~22.04.1
6.8.0-1030.32~22.04.1
ubuntu/linux-gke<5.15.0-1077.83
5.15.0-1077.83
ubuntu/linux-gkeop<5.15.0-1062.70
5.15.0-1062.70
ubuntu/linux-hwe-5.19*
ubuntu/linux-hwe-6.2*
ubuntu/linux-hwe-6.5*
ubuntu/linux-hwe-6.8<6.8.0-60.63~22.04.1
6.8.0-60.63~22.04.1
ubuntu/linux-ibm<5.15.0-1072.75
5.15.0-1072.75
ubuntu/linux-ibm-6.8<6.8.0-1026.26~22.04.1
6.8.0-1026.26~22.04.1
ubuntu/linux-intel-iot-realtime<5.15.0-1073.75
5.15.0-1073.75
ubuntu/linux-intel-iotg<5.15.0-1075.81
5.15.0-1075.81
ubuntu/linux-kvm<5.15.0-1076.81
5.15.0-1076.81
ubuntu/linux-lowlatency<5.15.0-135.146
5.15.0-135.146
ubuntu/linux-lowlatency-hwe-5.19*
ubuntu/linux-lowlatency-hwe-6.2*
ubuntu/linux-lowlatency-hwe-6.5*
ubuntu/linux-lowlatency-hwe-6.8<6.8.0-60.63.1~22.04.1
6.8.0-60.63.1~22.04.1
ubuntu/linux-nvidia<5.15.0-1074.75
5.15.0-1074.75
ubuntu/linux-nvidia-6.2*
ubuntu/linux-nvidia-6.5*
ubuntu/linux-nvidia-6.8<6.8.0-1028.31~22.04.1
6.8.0-1028.31~22.04.1
ubuntu/linux-nvidia-tegra<5.15.0-1033.33
5.15.0-1033.33
ubuntu/linux-nvidia-tegra-igx<5.15.0-1021.21
5.15.0-1021.21
ubuntu/linux-oem-5.17*
ubuntu/linux-oem-6.0*
ubuntu/linux-oem-6.1*
ubuntu/linux-oem-6.5*
ubuntu/linux-oracle<5.15.0-1077.83
5.15.0-1077.83
ubuntu/linux-oracle-6.5*
ubuntu/linux-oracle-6.8<6.8.0-1026.27~22.04.1
6.8.0-1026.27~22.04.1
ubuntu/linux-raspi<5.15.0-1074.77
5.15.0-1074.77
ubuntu/linux-realtime*
ubuntu/linux-riscv*
ubuntu/linux-riscv-5.19*
ubuntu/linux-riscv-6.5*
ubuntu/linux-riscv-6.8<6.8.0-62.65~22.04.1
6.8.0-62.65~22.04.1
ubuntu/linux-starfive-5.19*
ubuntu/linux-starfive-6.2*
ubuntu/linux-starfive-6.5*
ubuntu/linux-xilinx-zynqmp<5.15.0-1044.48
5.15.0-1044.48
ubuntu/linux-bluefield<5.15.0-1062.64
5.15.0-1062.64
ubuntu/linux-realtime<5.15.0-1080.88
5.15.0-1080.88
ubuntu/linux-realtime-6.8<6.8.1-1022.23~22.04.1
6.8.1-1022.23~22.04.1
ubuntu/linux-aws-fips*
ubuntu/linux-azure-fips*
ubuntu/linux-fips*
ubuntu/linux-gcp-fips*
ubuntu/linux-aws-fips<5.15.0-1080.87+fips1
5.15.0-1080.87+fips1
ubuntu/linux-azure-fips<5.15.0-1083.92+fips1
5.15.0-1083.92+fips1
ubuntu/linux-fips<5.15.0-135.146+fips1
5.15.0-135.146+fips1
ubuntu/linux-gcp-fips<5.15.0-1079.88+fips1
5.15.0-1079.88+fips1
ubuntu/linux<6.8.0-60.63
6.8.0-60.63
ubuntu/linux-aws<6.8.0-1029.31
6.8.0-1029.31
ubuntu/linux-azure<6.8.0-1029.34
6.8.0-1029.34
ubuntu/linux-azure-6.11<6.11.0-1012.12~24.04.1
6.11.0-1012.12~24.04.1
ubuntu/linux-azure-nvidia<6.8.0-1016.17
6.8.0-1016.17
ubuntu/linux-gcp<6.8.0-1030.32
6.8.0-1030.32
ubuntu/linux-gcp-6.11<6.11.0-1011.11~24.04.1
6.11.0-1011.11~24.04.1
ubuntu/linux-gke<6.8.0-1025.29
6.8.0-1025.29
ubuntu/linux-gkeop<6.8.0-1012.14
6.8.0-1012.14
ubuntu/linux-hwe-6.11<6.11.0-21.21~24.04.1
6.11.0-21.21~24.04.1
ubuntu/linux-ibm<6.8.0-1026.26
6.8.0-1026.26
ubuntu/linux-lowlatency<6.8.0-60.63.1
6.8.0-60.63.1
ubuntu/linux-nvidia<6.8.0-1028.31
6.8.0-1028.31
ubuntu/linux-nvidia-6.11<6.11.0-1007.7
6.11.0-1007.7
ubuntu/linux-nvidia-lowlatency<6.8.0-1028.31.1
6.8.0-1028.31.1
ubuntu/linux-nvidia-tegra<6.8.0-1008.8
6.8.0-1008.8
ubuntu/linux-oem-6.11<6.11.0-1017.17
6.11.0-1017.17
ubuntu/linux-oem-6.8<6.8.0-1028.28
6.8.0-1028.28
ubuntu/linux-oracle<6.8.0-1026.27
6.8.0-1026.27
ubuntu/linux-raspi<6.8.0-1028.32
6.8.0-1028.32
ubuntu/linux-raspi-realtime*
ubuntu/linux-realtime*
ubuntu/linux-riscv<6.8.0-60.63.1
6.8.0-60.63.1
ubuntu/linux-xilinx<6.8.0-1017.18
6.8.0-1017.18
ubuntu/linux-raspi-realtime<6.8.0-2023.24
6.8.0-2023.24
ubuntu/linux-realtime<6.8.1-1022.23
6.8.1-1022.23
ubuntu/linux-fips<6.8.0-78.78+fips1
6.8.0-78.78+fips1
debian/linux
6.1.176-16.1.190-16.12.107-16.12.115-27.2.12-17.2.15-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade debian/linux to a version that resolves this vulnerability.

    Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.27-1
  2. Upgrade

    Upgrade debian/linux-6.1 to a version that resolves this vulnerability.

    Fixed in 6.1.129-1~deb11u1
  3. Upgrade

    Upgrade ubuntu/linux-aws-5.4 to a version that resolves this vulnerability.

    Fixed in 5.4.0-1142.152~18.04.1
  4. Upgrade

    Upgrade ubuntu/linux-azure-5.4 to a version that resolves this vulnerability.

    Fixed in 5.4.0-1147.154~18.04.1
  5. Upgrade

    Upgrade ubuntu/linux-gcp-5.4 to a version that resolves this vulnerability.

    Fixed in 5.4.0-1145.154~18.04.1
  6. Upgrade

    Upgrade ubuntu/linux-hwe-5.4 to a version that resolves this vulnerability.

    Fixed in 5.4.0-211.231~18.04.1
  7. Upgrade

    Upgrade ubuntu/linux-ibm-5.4 to a version that resolves this vulnerability.

    Fixed in 5.4.0-1090.95~18.04.1
  8. Upgrade

    Upgrade ubuntu/linux-oracle-5.4 to a version that resolves this vulnerability.

    Fixed in 5.4.0-1140.149~18.04.1
  9. Upgrade

    Upgrade ubuntu/linux-raspi-5.4 to a version that resolves this vulnerability.

    Fixed in 5.4.0-1129.142~18.04.1
  10. Upgrade

    Upgrade ubuntu/linux to a version that resolves this vulnerability.

    Fixed in 5.4.0-211.231
  11. Upgrade

    Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.

    Fixed in 5.4.0-1142.152
  12. Upgrade

    Upgrade ubuntu/linux-aws-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-1080.87~20.04.1
  13. Upgrade

    Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.

    Fixed in 5.4.0-1147.154
  14. Upgrade

    Upgrade ubuntu/linux-azure-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-1086.95~20.04.1
  15. Upgrade

    Upgrade ubuntu/linux-bluefield to a version that resolves this vulnerability.

    Fixed in 5.4.0-1101.108
  16. Upgrade

    Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.

    Fixed in 5.4.0-1145.154
  17. Upgrade

    Upgrade ubuntu/linux-gcp-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-1081.90~20.04.1
  18. Upgrade

    Upgrade ubuntu/linux-hwe-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-136.147~20.04.1
  19. Upgrade

    Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.

    Fixed in 5.4.0-1088.93
  20. Upgrade

    Upgrade ubuntu/linux-ibm-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-1074.77~20.04.1
  21. Upgrade

    Upgrade ubuntu/linux-intel-iotg-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-1077.83~20.04.1
  22. Upgrade

    Upgrade ubuntu/linux-iot to a version that resolves this vulnerability.

    Fixed in 5.4.0-1048.51
  23. Upgrade

    Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.

    Fixed in 5.4.0-1129.138
  24. Upgrade

    Upgrade ubuntu/linux-lowlatency-hwe-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-135.146~20.04.1
  25. Upgrade

    Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.

    Fixed in 5.4.0-1140.150
  26. Upgrade

    Upgrade ubuntu/linux-oracle-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-1077.83~20.04.1
  27. Upgrade

    Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.

    Fixed in 5.4.0-1129.142
  28. Upgrade

    Upgrade ubuntu/linux-riscv-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-1075.79~20.04.1
  29. Upgrade

    Upgrade ubuntu/linux-xilinx-zynqmp to a version that resolves this vulnerability.

    Fixed in 5.4.0-1060.64
  30. Upgrade

    Upgrade ubuntu/linux-nvidia-tegra-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-1039.39~20.04.1
  31. Upgrade

    Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.

    Fixed in 5.4.0-1142.153+fips1
  32. Upgrade

    Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.

    Fixed in 5.4.0-1147.154+fips1
  33. Upgrade

    Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.

    Fixed in 5.4.0-1116.126
  34. Upgrade

    Upgrade ubuntu/linux-gcp-fips to a version that resolves this vulnerability.

    Fixed in 5.4.0-1145.154+fips1
  35. Upgrade

    Upgrade ubuntu/linux to a version that resolves this vulnerability.

    Fixed in 5.15.0-135.146
  36. Upgrade

    Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.

    Fixed in 5.15.0-1080.87
  37. Upgrade

    Upgrade ubuntu/linux-aws-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-1029.31~22.04.1
  38. Upgrade

    Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.

    Fixed in 5.15.0-1084.93
  39. Upgrade

    Upgrade ubuntu/linux-azure-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-1029.34~22.04.1
  40. Upgrade

    Upgrade ubuntu/linux-azure-fde to a version that resolves this vulnerability.

    Fixed in 5.15.0-1084.93.1
  41. Upgrade

    Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.

    Fixed in 5.15.0-1079.88
  42. Upgrade

    Upgrade ubuntu/linux-gcp-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-1030.32~22.04.1
  43. Upgrade

    Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.

    Fixed in 5.15.0-1077.83
  44. Upgrade

    Upgrade ubuntu/linux-gkeop to a version that resolves this vulnerability.

    Fixed in 5.15.0-1062.70
  45. Upgrade

    Upgrade ubuntu/linux-hwe-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-60.63~22.04.1
  46. Upgrade

    Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.

    Fixed in 5.15.0-1072.75
  47. Upgrade

    Upgrade ubuntu/linux-ibm-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-1026.26~22.04.1
  48. Upgrade

    Upgrade ubuntu/linux-intel-iot-realtime to a version that resolves this vulnerability.

    Fixed in 5.15.0-1073.75
  49. Upgrade

    Upgrade ubuntu/linux-intel-iotg to a version that resolves this vulnerability.

    Fixed in 5.15.0-1075.81
  50. Upgrade

    Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.

    Fixed in 5.15.0-1076.81
  51. Upgrade

    Upgrade ubuntu/linux-lowlatency to a version that resolves this vulnerability.

    Fixed in 5.15.0-135.146
  52. Upgrade

    Upgrade ubuntu/linux-lowlatency-hwe-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-60.63.1~22.04.1
  53. Upgrade

    Upgrade ubuntu/linux-nvidia to a version that resolves this vulnerability.

    Fixed in 5.15.0-1074.75
  54. Upgrade

    Upgrade ubuntu/linux-nvidia-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-1028.31~22.04.1
  55. Upgrade

    Upgrade ubuntu/linux-nvidia-tegra to a version that resolves this vulnerability.

    Fixed in 5.15.0-1033.33
  56. Upgrade

    Upgrade ubuntu/linux-nvidia-tegra-igx to a version that resolves this vulnerability.

    Fixed in 5.15.0-1021.21
  57. Upgrade

    Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.

    Fixed in 5.15.0-1077.83
  58. Upgrade

    Upgrade ubuntu/linux-oracle-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-1026.27~22.04.1
  59. Upgrade

    Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.

    Fixed in 5.15.0-1074.77
  60. Upgrade

    Upgrade ubuntu/linux-riscv-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-62.65~22.04.1
  61. Upgrade

    Upgrade ubuntu/linux-xilinx-zynqmp to a version that resolves this vulnerability.

    Fixed in 5.15.0-1044.48
  62. Upgrade

    Upgrade ubuntu/linux-bluefield to a version that resolves this vulnerability.

    Fixed in 5.15.0-1062.64
  63. Upgrade

    Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.

    Fixed in 5.15.0-1080.88
  64. Upgrade

    Upgrade ubuntu/linux-realtime-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.1-1022.23~22.04.1
  65. Upgrade

    Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.

    Fixed in 5.15.0-1080.87+fips1
  66. Upgrade

    Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.

    Fixed in 5.15.0-1083.92+fips1
  67. Upgrade

    Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.

    Fixed in 5.15.0-135.146+fips1
  68. Upgrade

    Upgrade ubuntu/linux-gcp-fips to a version that resolves this vulnerability.

    Fixed in 5.15.0-1079.88+fips1
  69. Upgrade

    Upgrade ubuntu/linux to a version that resolves this vulnerability.

    Fixed in 6.8.0-60.63
  70. Upgrade

    Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.

    Fixed in 6.8.0-1029.31
  71. Upgrade

    Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.

    Fixed in 6.8.0-1029.34
  72. Upgrade

    Upgrade ubuntu/linux-azure-6.11 to a version that resolves this vulnerability.

    Fixed in 6.11.0-1012.12~24.04.1
  73. Upgrade

    Upgrade ubuntu/linux-azure-nvidia to a version that resolves this vulnerability.

    Fixed in 6.8.0-1016.17
  74. Upgrade

    Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.

    Fixed in 6.8.0-1030.32
  75. Upgrade

    Upgrade ubuntu/linux-gcp-6.11 to a version that resolves this vulnerability.

    Fixed in 6.11.0-1011.11~24.04.1
  76. Upgrade

    Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.

    Fixed in 6.8.0-1025.29
  77. Upgrade

    Upgrade ubuntu/linux-gkeop to a version that resolves this vulnerability.

    Fixed in 6.8.0-1012.14
  78. Upgrade

    Upgrade ubuntu/linux-hwe-6.11 to a version that resolves this vulnerability.

    Fixed in 6.11.0-21.21~24.04.1
  79. Upgrade

    Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.

    Fixed in 6.8.0-1026.26
  80. Upgrade

    Upgrade ubuntu/linux-lowlatency to a version that resolves this vulnerability.

    Fixed in 6.8.0-60.63.1
  81. Upgrade

    Upgrade ubuntu/linux-nvidia to a version that resolves this vulnerability.

    Fixed in 6.8.0-1028.31
  82. Upgrade

    Upgrade ubuntu/linux-nvidia-6.11 to a version that resolves this vulnerability.

    Fixed in 6.11.0-1007.7
  83. Upgrade

    Upgrade ubuntu/linux-nvidia-lowlatency to a version that resolves this vulnerability.

    Fixed in 6.8.0-1028.31.1
  84. Upgrade

    Upgrade ubuntu/linux-nvidia-tegra to a version that resolves this vulnerability.

    Fixed in 6.8.0-1008.8
  85. Upgrade

    Upgrade ubuntu/linux-oem-6.11 to a version that resolves this vulnerability.

    Fixed in 6.11.0-1017.17
  86. Upgrade

    Upgrade ubuntu/linux-oem-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-1028.28
  87. Upgrade

    Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.

    Fixed in 6.8.0-1026.27
  88. Upgrade

    Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.

    Fixed in 6.8.0-1028.32
  89. Upgrade

    Upgrade ubuntu/linux-riscv to a version that resolves this vulnerability.

    Fixed in 6.8.0-60.63.1
  90. Upgrade

    Upgrade ubuntu/linux-xilinx to a version that resolves this vulnerability.

    Fixed in 6.8.0-1017.18
  91. Upgrade

    Upgrade ubuntu/linux-raspi-realtime to a version that resolves this vulnerability.

    Fixed in 6.8.0-2023.24
  92. Upgrade

    Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.

    Fixed in 6.8.1-1022.23
  93. Upgrade

    Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.

    Fixed in 6.8.0-78.78+fips1

Event History

Jan 19, 2025
CVE Published
via MITRE·10:18 AM
Data Sourced
via MITRE·10:18 AM
Description
Data Sourced
via OSV·11:15 AM
DescriptionSeverityAffected Software
Event
via OSV·11:15 AM
Data Sourced
via NVD·11:15 AM
RemedyDescriptionSeverityAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

1

What is the severity of CVE-2025-21653?

CVE-2025-21653 has a high severity due to its potential for exploitation leading to undefined behavior in the Linux kernel.

2

How do I fix CVE-2025-21653?

To fix CVE-2025-21653, update your Linux kernel to a version that includes the patch addressing the TCA_FLOW_RSHIFT attribute validation.

3

What systems are affected by CVE-2025-21653?

CVE-2025-21653 affects the Linux kernel across various distributions and versions.

4

What are the consequences of exploiting CVE-2025-21653?

Exploiting CVE-2025-21653 may lead to system instability or arbitrary code execution due to undefined behavior.

5

When was CVE-2025-21653 discovered?

CVE-2025-21653 was discovered and reported by syzbot in relation to the validation of the TCA_FLOW_RSHIFT attribute.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203