CVE-2025-37752

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net_sched: sch_sfq: move the limit validation

It is not sufficient to directly validate the limit on the data that

the user passes as it can be updated based on how the other parameters

are changed.

Move the check at the end of the configuration update process to also

catch scenarios where the limit is indirectly updated, for example

with the following configurations:

tc qdisc add dev dummy0 handle 1: root sfq limit 2 flows 1 depth 1

tc qdisc add dev dummy0 handle 1: root sfq limit 2 flows 1 divisor 1

This fixes the following syzkaller reported crash:

------------[ cut here ]------------

UBSAN: array-index-out-of-bounds in net/sched/sch_sfq.c:203:6

index 65535 is out of range for type 'struct sfq_head[128]'

CPU: 1 UID: 0 PID: 3037 Comm: syz.2.16 Not tainted 6.14.0-rc2-syzkaller #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024

Call Trace:

<TASK>

__dump_stack lib/dump_s

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References