CVE-2025-38193: net_sched: sch_sfq: reject invalid perturb period
In the Linux kernel, the following vulnerability has been resolved:
netsched: schsfq: reject invalid perturb period
Gerrard Tai reported that SFQ perturbperiod has no range check yet, and this can be used to trigger a race condition fixed in a separate patch.
We want to make sure ctl->perturbperiod HZ will not overflow and is positive.
tc qd add dev lo root sfq perturb -10 # negative value : error Error: schsfq: invalid perturb period.
tc qd add dev lo root sfq perturb 1000000000 # too big : error Error: schsfq: invalid perturb period.
tc qd add dev lo root sfq perturb 2000000 # acceptable value tc -s -d qd sh dev lo qdisc sfq 8005: root refcnt 2 limit 127p quantum 64Kb depth 127 flows 128 divisor 1024 perturb 2000000sec Sent 0 bytes 0 pkt (dropped 0, overlimits 0 requeues 0) backlog 0b 0p requeues 0
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1 - Configuration
Configure the SFQ perturb period to a positive, non-overflowing value; 2000000 seconds is shown as an acceptable value. Reject negative values such as -10 and excessively large values such as 1000000000.
Linux kernel net_sched sch_sfq perturb_period = 2000000
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38193?
CVE-2025-38193 has a medium severity level due to its potential to trigger a race condition.
How do I fix CVE-2025-38193?
To mitigate CVE-2025-38193, update the Linux kernel to the latest stable version where the vulnerability has been patched.
What are the potential impacts of CVE-2025-38193?
The impacts of CVE-2025-38193 may include system instability or unexpected behavior due to the race condition.
Who reported CVE-2025-38193?
CVE-2025-38193 was reported by Gerrard Tai.
What component of the Linux kernel is affected by CVE-2025-38193?
CVE-2025-38193 affects the net_sched component, specifically the sch_sfq implementation.