CVE-2025-38193

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-38193
In the Linux kernel, the following vulnerability has been resolved: net_sched: sch_sfq: reject invalid perturb period Gerrard Tai reported that SFQ perturb_period has no range check yet, and this can be used to trigger a race condition fixed in a separate patch. We want to make sure ctl->perturb_period * HZ will not overflow and is positive. tc qd add dev lo root sfq perturb -10 # negative value : error Error: sch_sfq: invalid perturb period. tc qd add dev lo root sfq perturb 1000000000 # too big : error Error: sch_sfq: invalid perturb period. tc qd add dev lo root sfq perturb 2000000 # acceptable value tc -s -d qd sh dev lo qdisc sfq 8005: root refcnt 2 limit 127p quantum 64Kb depth 127 flows 128 divisor 1024 perturb 2000000sec Sent 0 bytes 0 pkt (dropped 0, overlimits 0 requeues 0) backlog 0b 0p requeues 0

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/0357da9149eac621f39e235a135ebf155f01f7c3 Patch
https://git.kernel.org/stable/c/2254d038dab9c194fe6a4b1ce31034f42e91a6e5 Patch
https://git.kernel.org/stable/c/590b2d7d0beadba2aa576708a05a05f0aae39295 Patch
https://git.kernel.org/stable/c/7ca52541c05c832d32b112274f81a985101f9ba8 Patch
https://git.kernel.org/stable/c/956b5aebb349449b38d920d444ca1392d43719d1 Patch
https://git.kernel.org/stable/c/b11a50544af691b787384089b68f740ae20a441b Patch
https://git.kernel.org/stable/c/e0936ff56be4e08ad5b60ec26971eae0c40af305 Patch
https://git.kernel.org/stable/c/f9b97d466e6026ccbdda30bb5b71965b67ccbc82 Patch
https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html Third Party Advisory
https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html Third Party Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.12:-:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.12:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.12:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.12:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.12:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
History

18 Dec 2025, 21:25

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
CWE CWE-190
CPE cpe:2.3:o:linux:linux_kernel:2.6.12:rc2:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.12:-:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.12:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.12:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.12:rc3:*:*:*:*:*:*
References () https://git.kernel.org/stable/c/0357da9149eac621f39e235a135ebf155f01f7c3 - () https://git.kernel.org/stable/c/0357da9149eac621f39e235a135ebf155f01f7c3 - Patch
References () https://git.kernel.org/stable/c/2254d038dab9c194fe6a4b1ce31034f42e91a6e5 - () https://git.kernel.org/stable/c/2254d038dab9c194fe6a4b1ce31034f42e91a6e5 - Patch
References () https://git.kernel.org/stable/c/590b2d7d0beadba2aa576708a05a05f0aae39295 - () https://git.kernel.org/stable/c/590b2d7d0beadba2aa576708a05a05f0aae39295 - Patch
References () https://git.kernel.org/stable/c/7ca52541c05c832d32b112274f81a985101f9ba8 - () https://git.kernel.org/stable/c/7ca52541c05c832d32b112274f81a985101f9ba8 - Patch
References () https://git.kernel.org/stable/c/956b5aebb349449b38d920d444ca1392d43719d1 - () https://git.kernel.org/stable/c/956b5aebb349449b38d920d444ca1392d43719d1 - Patch
References () https://git.kernel.org/stable/c/b11a50544af691b787384089b68f740ae20a441b - () https://git.kernel.org/stable/c/b11a50544af691b787384089b68f740ae20a441b - Patch
References () https://git.kernel.org/stable/c/e0936ff56be4e08ad5b60ec26971eae0c40af305 - () https://git.kernel.org/stable/c/e0936ff56be4e08ad5b60ec26971eae0c40af305 - Patch
References () https://git.kernel.org/stable/c/f9b97d466e6026ccbdda30bb5b71965b67ccbc82 - () https://git.kernel.org/stable/c/f9b97d466e6026ccbdda30bb5b71965b67ccbc82 - Patch
References () https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html - () https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html - Third Party Advisory
References () https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html - () https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html - Third Party Advisory
First Time Linux
Debian
Debian debian Linux
Linux linux Kernel

03 Nov 2025, 18:16

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html -
  • () https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html -

28 Aug 2025, 15:15

Type Values Removed Values Added
References
  • () https://git.kernel.org/stable/c/e0936ff56be4e08ad5b60ec26971eae0c40af305 -

17 Jul 2025, 17:15

Type Values Removed Values Added
References
  • () https://git.kernel.org/stable/c/2254d038dab9c194fe6a4b1ce31034f42e91a6e5 -

08 Jul 2025, 16:18

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net_sched: sch_sfq: rechaza un período de perturbación no válido. Gerrard Tai informó que SFQ perturb_period aún no tiene comprobación de rango, lo que puede usarse para activar una condición de ejecución corregida en un parche independiente. Queremos asegurarnos de que ctl->perturb_period * HZ no se desborde y sea positivo. tc qd add dev lo root sfq perturb -10 # valor negativo: error. Error: sch_sfq: período de perturbación no válido. tc qd add dev lo root sfq perturb 100000000 # demasiado grande: error. Error: sch_sfq: período de perturbación no válido. tc qd add dev lo root sfq perturb 2000000 # valor aceptable tc -s -d qd sh dev lo qdisc sfq 8005: root refcnt 2 limit 127p quantum 64Kb Depth 127 flows 128 divisor 1024 perturb 2000000sec Enviados 0 bytes 0 paquete (eliminados 0, sobrepasa los límites 0, vuelve a poner en cola 0) backlog 0b 0p vuelve a poner en cola 0

04 Jul 2025, 14:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-07-04 14:15

Updated : 2025-12-18 21:25

NVD link : CVE-2025-38193

Mitre link : CVE-2025-38193

CVE.ORG link : CVE-2025-38193

JSON object : View

Products Affected

debian

  • debian_linux

linux

  • linux_kernel
CWE
CWE-190

Integer Overflow or Wraparound