VYPR
← All advisories
High severity7.1NVD Advisory· Published Jan 19, 2025· Updated May 12, 2026

CVE-2025-21647

CVE-2025-21647

Description

In the Linux kernel, the following vulnerability has been resolved:

sched: sch_cake: add bounds checks to host bulk flow fairness counts

Even though we fixed a logic error in the commit cited below, syzbot still managed to trigger an underflow of the per-host bulk flow counters, leading to an out of bounds memory access.

To avoid any such logic errors causing out of bounds memory accesses, this commit factors out all accesses to the per-host bulk flow counters to a series of helpers that perform bounds-checking before any increments and decrements. This also has the benefit of improving readability by moving the conditional checks for the flow mode into these helpers, instead of having them spread out throughout the code (which was the cause of the original logic error).

As part of this change, the flow quantum calculation is consolidated into a helper function, which means that the dithering applied to the ost load scaling is now applied both in the DRR rotation and when a sparse flow's quantum is first initiated. The only user-visible effect of this is that the maximum packet size that can be sent while a flow stays sparse will now vary with +/- one byte in some cases. This should not make a noticeable difference in practice, and thus it's not worth complicating the code to preserve the old behaviour.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

A bounds-checking flaw in Linux kernel's sch_cake network scheduler can cause out-of-bounds memory access via bulk flow counter underflow.

Vulnerability

Overview

CVE-2025-21647 is a high-severity vulnerability (CVSS 7.1) in the Linux kernel's sch_cake network scheduler, specifically in the host bulk flow fairness counters. Despite a prior fix for a logic error, an underflow of per-host bulk flow counters could still occur, leading to out-of-bounds memory access. The commit fixes this by adding bounds-checking helper functions for all accesses to these counters, preventing underflow and overflows [1][description].

Attack

Vector and Exploitation

The vulnerability is exploitable by network traffic that triggers the bulk flow fairness mechanism in sch_cake. An attacker on the local network could craft traffic to manipulate the per-host counters, causing an underflow. No authentication is required beyond network access to the affected system. The condition can be triggered without special privileges, making it a relatively low-barrier attack vector [description].

Impact

Successful exploitation results in out-of-bounds memory access, which could lead to system instability, denial of service, or potentially memory corruption. The attacker may cause the kernel to crash or behave unpredictably, impacting the availability of the system. Given the kernel context, this could also enable further exploitation in some scenarios [description].

Mitigation

The fix has been incorporated into the Linux kernel stable tree. Users should apply the kernel update containing commits such as those cited in references [3] and [4] to ensure the bounds-checking helpers are in place. Affected products include those using Linux subsystems, such as the SIMATIC S7-1500 TM MFP, where Siemens recommends updating the GNU/Linux subsystem [1][2].

References
  1. SSA-265688
  2. SSA-503939
  3. Making sure you're not a bot!
  4. Making sure you're not a bot!

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

175

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

11

News mentions

0

No linked articles in our index yet.