CVE-2025-21647

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

sched: sch_cake: add bounds checks to host bulk flow fairness counts

Even though we fixed a logic error in the commit cited below, syzbot

still managed to trigger an underflow of the per-host bulk flow

counters, leading to an out of bounds memory access.

To avoid any such logic errors causing out of bounds memory accesses,

this commit factors out all accesses to the per-host bulk flow counters

to a series of helpers that perform bounds-checking before any

increments and decrements. This also has the benefit of improving

readability by moving the conditional checks for the flow mode into

these helpers, instead of having them spread out throughout the

code (which was the cause of the original logic error).

As part of this change, the flow quantum calculation is consolidated

into a helper function, which means that the dithering applied to the

ost load scaling is now applied both in the DRR rotation and when a

sparse

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References