Out-of-Bounds Stack Write Vulnerability in Linux Kernel - Affects Debian Packages
Summary
DEBIAN-CVE-2025-38568: In the Linux kernel, the following vulnerability has been resolved: net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing TCA_MQPRIO_TC_ENTRY_INDEX is validated using NLA_POLICY_MAX(NLA_U32, TC_QOPT_MAX_QU... Affects linux versions < 6.12.43-1. Fixed in 6.12.43-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Debian operating system, responsible for managing hardware and system resources. It provides essential services for all other software running on the system. The kernel is designed for stability and security, but vulnerabilities can arise, potentially compromising system integrity. This specific vulnerability affects the 'linux' package in Debian 13 and 14, highlighting a critical issue in the network scheduling subsystem.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the net/sched subsystem related to the mqprio feature. The issue arises from improper validation of the TCA_MQPRIO_TC_ENTRY_INDEX parameter, which is allowed to take a value up to TC_QOPT_MAX_QUEUE (16). This leads to a 4-byte out-of-bounds write in the fp[] array, which is only allocated for 16 elements (0-15). If exploited, this could potentially lead to arbitrary code execution or system crashes, compromising the stability and security of the affected systems.
How To Fix
Minimum fixed version
6.12.43-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. The best course of action is to apply the available patches as soon as possible.
Conclusion
The out-of-bounds stack write vulnerability in the Linux kernel poses a significant risk to Debian systems. Users are strongly advised to update their 'linux' package to the latest patched versions to ensure system security and stability. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for linux →
FAQ
The vulnerability is an out-of-bounds stack write in the Linux kernel's network scheduling subsystem, which can lead to potential system instability or arbitrary code execution.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. By using the Vulert playground, you can check if your application is affected without any signup.
Exploitation of this vulnerability could result in system crashes, data corruption, or unauthorized access to system resources.
Yes, patches are available for both Debian 13 and 14. Users should update to the specified fixed versions to mitigate the risk.
While there are no specific workarounds, it is crucial to prioritize applying the patch as soon as possible to protect your system from potential exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
