CVE-2025-37752 Overview
CVE-2025-37752 is an out-of-bounds array access vulnerability in the Linux kernel's net_sched subsystem, specifically in the Stochastic Fairness Queueing (SFQ) packet scheduler at net/sched/sch_sfq.c. The flaw stems from insufficient validation of the limit parameter, which can be indirectly modified through related configuration parameters such as flows, depth, and divisor. A local attacker with CAP_NET_ADMIN capability can trigger an out-of-bounds write by submitting crafted tc qdisc configurations, leading to kernel memory corruption. The issue was discovered through syzkaller fuzzing and affects multiple stable Linux kernel branches as well as Debian Linux distributions.
Critical Impact
Local attackers with network administration privileges can corrupt kernel memory through crafted traffic control configurations, potentially leading to denial of service or privilege escalation.
Affected Products
- Linux Kernel (multiple stable branches up to 6.15-rc1)
- Debian Linux 11.0
- Systems using the SFQ qdisc in net_sched
Discovery Timeline
- 2025-05-01 - CVE-2025-37752 published to NVD
- 2025-11-04 - Last updated in NVD database
Technical Details for CVE-2025-37752
Vulnerability Analysis
The vulnerability resides in the SFQ packet scheduler implementation within net/sched/sch_sfq.c. SFQ uses a fixed-size array struct sfq_head[128] to track flow buckets. The limit parameter governs the maximum number of packets the qdisc holds, but its validation was performed only against the value the user directly supplied. When limit is recalculated based on other parameters such as flows, depth, or divisor, the recomputed value bypasses the original check.
A syzkaller-generated reproducer demonstrates the issue using two configurations:
- tc qdisc add dev dummy0 handle 1: root sfq limit 2 flows 1 depth 1
- tc qdisc add dev dummy0 handle 1: root sfq limit 2 flows 1 divisor 1
These configurations cause the index used in sfq_link() to reach 65535, well beyond the valid range for struct sfq_head[128]. The kernel UBSAN sanitizer flags this as array-index-out-of-bounds in net/sched/sch_sfq.c:203:6. The corruption is triggered through the call chain sfq_dequeue → sfq_dec → sfq_link, often during qdisc reset operations such as dev_deactivate_many.
Root Cause
The root cause is improper validation of an array index [CWE-129]. The fix moves the limit validation to the end of the configuration update process, ensuring that indirectly derived values are also checked before use. Without this ordering, parameter interactions silently produce out-of-range indices that the kernel later dereferences.
Attack Vector
Exploitation requires local access and the CAP_NET_ADMIN capability, typically held by root or by processes inside network-administering user namespaces. An attacker invokes tc qdisc add or tc qdisc change with specific combinations of limit, flows, depth, and divisor to induce the out-of-bounds condition. Successful exploitation can corrupt adjacent kernel heap memory, leading to denial of service via kernel panic or, in theory, privilege escalation through controlled memory writes.
Detection Methods for CVE-2025-37752
Indicators of Compromise
- Kernel log entries containing UBSAN: array-index-out-of-bounds in net/sched/sch_sfq.c
- Unexpected kernel oops or panic referencing sfq_link, sfq_dec, or sfq_dequeue
- Crashes occurring during qdisc_reset or dev_deactivate_many operations
- Unusual tc qdisc invocations from non-administrative processes
Detection Strategies
- Audit usage of the tc utility and direct netlink calls invoking SFQ qdisc configuration on production hosts
- Monitor dmesg and kernel ring buffer output for UBSAN and KASAN reports referencing sch_sfq
- Track invocations of processes holding CAP_NET_ADMIN that perform qdisc modifications outside expected change windows
Monitoring Recommendations
- Forward kernel logs to a central log aggregation platform and alert on UBSAN messages referencing scheduling code
- Baseline legitimate tc qdisc activity per host and flag deviations involving SFQ with unusual flows, depth, or divisor values
- Enable kernel auditing (auditd) on netlink socket creation and capability use for CAP_NET_ADMIN
How to Mitigate CVE-2025-37752
Immediate Actions Required
- Apply the upstream Linux kernel patches that relocate SFQ limit validation to the end of the configuration update flow
- Update Debian systems per the Debian LTS Announcement
- Restrict CAP_NET_ADMIN to trusted administrative accounts and audit user-namespace configurations that grant it
Patch Information
The fix is distributed across multiple stable kernel commits, including 1348214fa042, 5e5e1fcc1b8e, 6c589aa31802, 7d62ded97db6, 8fadc871a429, b36a68192037, b3bf8f63e617, d2718324f9e3, and f86293adce0c. Operators should apply the commit corresponding to their stable branch.
Workarounds
- Avoid loading or using the SFQ qdisc on hosts that cannot be patched immediately
- Block the sch_sfq kernel module from loading where it is not required, for example by adding install sch_sfq /bin/true to a modprobe configuration file
- Disable unprivileged user namespaces (kernel.unprivileged_userns_clone=0) to limit who can acquire CAP_NET_ADMIN
# Configuration example
# Prevent the vulnerable SFQ qdisc module from loading
echo 'install sch_sfq /bin/true' | sudo tee /etc/modprobe.d/disable-sch_sfq.conf
# Disable unprivileged user namespaces to limit CAP_NET_ADMIN acquisition
sudo sysctl -w kernel.unprivileged_userns_clone=0
echo 'kernel.unprivileged_userns_clone=0' | sudo tee -a /etc/sysctl.d/99-hardening.conf
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
