CVE-2025-38568

{"id": "CVE-2025-38568", "cveTags": [], "metrics": {}, "published": "2025-08-19T17:15:33.523", "references": [{"url": "https://git.kernel.org/stable/c/39491e859fd494d0b51adc5c7d54c8a7dcf1d198", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/66fc2ebdd9d5dd6e5a9c7edeace5a61a0ab2cd86", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/d00e4125680f7074c4f42ce3c297336f23128e70", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/f1a9dbcb7d17bf0abb325cdc984957cfabc59693", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/ffd2dc4c6c49ff4f1e5d34e454a6a55608104c17", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Awaiting Analysis", "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: mqprio: fix stack out-of-bounds write in tc entry parsing\n\nTCA_MQPRIO_TC_ENTRY_INDEX is validated using\nNLA_POLICY_MAX(NLA_U32, TC_QOPT_MAX_QUEUE), which allows the value\nTC_QOPT_MAX_QUEUE (16). This leads to a 4-byte out-of-bounds stack\nwrite in the fp[] array, which only has room for 16 elements (0\u201315).\n\nFix this by changing the policy to allow only up to TC_QOPT_MAX_QUEUE - 1."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net/sched: mqprio: se corrige una escritura fuera de los l\u00edmites en la pila durante el an\u00e1lisis de la entrada tc. TCA_MQPRIO_TC_ENTRY_INDEX se valida mediante NLA_POLICY_MAX(NLA_U32, TC_QOPT_MAX_QUEUE), que permite el valor TC_QOPT_MAX_QUEUE (16). Esto provoca una escritura fuera de los l\u00edmites de 4 bytes en la matriz fp[], que solo admite 16 elementos (0-15). Para solucionar esto, modifique la pol\u00edtica para permitir solo hasta TC_QOPT_MAX_QUEUE - 1."}], "lastModified": "2025-08-20T14:40:17.713", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}