CVE-2025-37752 — Improper Validation of Array Index in Linux
Severity
7.8HIGHNVD
OSV8.4OSV5.5
EPSS
0.0%
top 89.47%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedMay 1
Latest updateNov 21
Description
In the Linux kernel, the following vulnerability has been resolved:
net_sched: sch_sfq: move the limit validation
It is not sufficient to directly validate the limit on the data that
the user passes as it can be updated based on how the other parameters
are changed.
Move the check at the end of the configuration update process to also
catch scenarios where the limit is indirectly updated, for example
with the following configurations:
tc qdisc add dev dummy0 handle 1: root sfq limit 2 flows …
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9
Affected Packages7 packages
▶CVEListV5linux/linuxe12f6013d0a69660e8b99bfe381b9546ae667328 — 8fadc871a42933aacb7f1ce9ed9a96485e2c9cf4+9
Also affects: Debian Linux 11.0