In the Linux kernel, the following vulnerability has been resolved:
netsched: schsfq: reject invalid perturb period
Gerrard Tai reported that SFQ perturb_period has no range check yet, and this can be used to trigger a race condition fixed in a separate patch.
We want to make sure ctl->perturb_period * HZ will not overflow and is positive.
tc qd add dev lo root sfq perturb -10 # negative value : error Error: sch_sfq: invalid perturb period.
tc qd add dev lo root sfq perturb 1000000000 # too big : error Error: sch_sfq: invalid perturb period.
tc qd add dev lo root sfq perturb 2000000 # acceptable value tc -s -d qd sh dev lo qdisc sfq 8005: root refcnt 2 limit 127p quantum 64Kb depth 127 flows 128 divisor 1024 perturb 2000000sec Sent 0 bytes 0 pkt (dropped 0, overlimits 0 requeues 0) backlog 0b 0p requeues 0
[
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7ca52541c05c832d32b112274f81a985101f9ba8",
"deprecated": false,
"id": "CVE-2025-38193-17a654f4",
"signature_type": "Function",
"digest": {
"length": 2510.0,
"function_hash": "165824621853567536556208239600444839603"
},
"target": {
"function": "sfq_change",
"file": "net/sched/sch_sfq.c"
}
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@956b5aebb349449b38d920d444ca1392d43719d1",
"deprecated": false,
"id": "CVE-2025-38193-21f54e9a",
"signature_type": "Function",
"digest": {
"length": 2510.0,
"function_hash": "165824621853567536556208239600444839603"
},
"target": {
"function": "sfq_change",
"file": "net/sched/sch_sfq.c"
}
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@590b2d7d0beadba2aa576708a05a05f0aae39295",
"deprecated": false,
"id": "CVE-2025-38193-361b0758",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"255751926469918324587446756344910996906",
"226163241294344152536442629836775770298",
"200205403450376163464850770982960301832",
"236937024768369791638042547106215479346",
"165250922056858203833616927413562161605",
"131550328840939730553367457609952963538",
"11340391078796449921102772915201014287",
"77792162641326990290343187847403304083",
"68801365582419187793547910340158664411",
"97413374798031775708830728946888348132",
"257375825888547311349667083933355646730",
"149805607848586988876432585852825384212",
"173890458303700113595361174508612604858"
]
},
"target": {
"file": "net/sched/sch_sfq.c"
}
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@590b2d7d0beadba2aa576708a05a05f0aae39295",
"deprecated": false,
"id": "CVE-2025-38193-442da526",
"signature_type": "Function",
"digest": {
"length": 2510.0,
"function_hash": "165824621853567536556208239600444839603"
},
"target": {
"function": "sfq_change",
"file": "net/sched/sch_sfq.c"
}
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2254d038dab9c194fe6a4b1ce31034f42e91a6e5",
"deprecated": false,
"id": "CVE-2025-38193-4bfe474d",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"255751926469918324587446756344910996906",
"226163241294344152536442629836775770298",
"200205403450376163464850770982960301832",
"236937024768369791638042547106215479346",
"165250922056858203833616927413562161605",
"131550328840939730553367457609952963538",
"11340391078796449921102772915201014287",
"77792162641326990290343187847403304083",
"68801365582419187793547910340158664411",
"97413374798031775708830728946888348132",
"257375825888547311349667083933355646730",
"149805607848586988876432585852825384212",
"173890458303700113595361174508612604858"
]
},
"target": {
"file": "net/sched/sch_sfq.c"
}
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e0936ff56be4e08ad5b60ec26971eae0c40af305",
"deprecated": false,
"id": "CVE-2025-38193-88969ccf",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"255751926469918324587446756344910996906",
"226163241294344152536442629836775770298",
"200205403450376163464850770982960301832",
"236937024768369791638042547106215479346",
"165250922056858203833616927413562161605",
"131550328840939730553367457609952963538",
"11340391078796449921102772915201014287",
"77792162641326990290343187847403304083",
"68801365582419187793547910340158664411",
"97413374798031775708830728946888348132",
"257375825888547311349667083933355646730",
"149805607848586988876432585852825384212",
"173890458303700113595361174508612604858"
]
},
"target": {
"file": "net/sched/sch_sfq.c"
}
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0357da9149eac621f39e235a135ebf155f01f7c3",
"deprecated": false,
"id": "CVE-2025-38193-9256cd61",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"255751926469918324587446756344910996906",
"226163241294344152536442629836775770298",
"200205403450376163464850770982960301832",
"236937024768369791638042547106215479346",
"165250922056858203833616927413562161605",
"131550328840939730553367457609952963538",
"11340391078796449921102772915201014287",
"77792162641326990290343187847403304083",
"68801365582419187793547910340158664411",
"97413374798031775708830728946888348132",
"257375825888547311349667083933355646730",
"149805607848586988876432585852825384212",
"173890458303700113595361174508612604858"
]
},
"target": {
"file": "net/sched/sch_sfq.c"
}
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0357da9149eac621f39e235a135ebf155f01f7c3",
"deprecated": false,
"id": "CVE-2025-38193-aeb3c4af",
"signature_type": "Function",
"digest": {
"length": 2510.0,
"function_hash": "165824621853567536556208239600444839603"
},
"target": {
"function": "sfq_change",
"file": "net/sched/sch_sfq.c"
}
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2254d038dab9c194fe6a4b1ce31034f42e91a6e5",
"deprecated": false,
"id": "CVE-2025-38193-b9d92f89",
"signature_type": "Function",
"digest": {
"length": 2510.0,
"function_hash": "165824621853567536556208239600444839603"
},
"target": {
"function": "sfq_change",
"file": "net/sched/sch_sfq.c"
}
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7ca52541c05c832d32b112274f81a985101f9ba8",
"deprecated": false,
"id": "CVE-2025-38193-bce6f4cf",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"255751926469918324587446756344910996906",
"226163241294344152536442629836775770298",
"200205403450376163464850770982960301832",
"236937024768369791638042547106215479346",
"165250922056858203833616927413562161605",
"131550328840939730553367457609952963538",
"11340391078796449921102772915201014287",
"77792162641326990290343187847403304083",
"68801365582419187793547910340158664411",
"97413374798031775708830728946888348132",
"257375825888547311349667083933355646730",
"149805607848586988876432585852825384212",
"173890458303700113595361174508612604858"
]
},
"target": {
"file": "net/sched/sch_sfq.c"
}
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@956b5aebb349449b38d920d444ca1392d43719d1",
"deprecated": false,
"id": "CVE-2025-38193-ccb5ca75",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"255751926469918324587446756344910996906",
"226163241294344152536442629836775770298",
"200205403450376163464850770982960301832",
"236937024768369791638042547106215479346",
"165250922056858203833616927413562161605",
"131550328840939730553367457609952963538",
"11340391078796449921102772915201014287",
"77792162641326990290343187847403304083",
"68801365582419187793547910340158664411",
"97413374798031775708830728946888348132",
"257375825888547311349667083933355646730",
"149805607848586988876432585852825384212",
"173890458303700113595361174508612604858"
]
},
"target": {
"file": "net/sched/sch_sfq.c"
}
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e0936ff56be4e08ad5b60ec26971eae0c40af305",
"deprecated": false,
"id": "CVE-2025-38193-dc25341b",
"signature_type": "Function",
"digest": {
"length": 2510.0,
"function_hash": "165824621853567536556208239600444839603"
},
"target": {
"function": "sfq_change",
"file": "net/sched/sch_sfq.c"
}
}
]