CVE-2025-37821

published 2025-05-08

CVE-2025-37821: In the Linux kernel, the following vulnerability has been resolved: sched/eevdf: Fix se->slice being set to U64_MAX and resulting crash There is a code path in…

Priority P4 20 medium 5.5 CVSS 3.1

AV L AC L PR L UI N S U C N I N A H

In the Linux kernel, the following vulnerability has been resolved:

sched/eevdf: Fix se->slice being set to U64_MAX and resulting crash

There is a code path in dequeue_entities() that can set the slice of a
sched_entity to U64_MAX, which sometimes results in a crash.

The offending case is when dequeue_entities() is called to dequeue a
delayed group entity, and then the entity's parent's dequeue is delayed.
In that case:

1. In the if (entity_is_task(se)) else block at the beginning of
dequeue_entities(), slice is set to
cfs_rq_min_slice(group_cfs_rq(se)). If the entity was delayed, then
it has no queued tasks, so cfs_rq_min_slice() returns U64_MAX.
2. The first for_each_sched_entity() loop dequeues the entity.
3. If the entity was its parent's only child, then the next iteration
tries to dequeue the parent.
4. If the parent's dequeue needs to be delayed, then it breaks from the
first for_each_sched_entity() loop _without updating slice_.
5. The second for_each_sched_entity() loop sets the parent's ->slice to
the saved slice, which is still U64_MAX.

This throws off subsequent calculations with potentially catastrophic
results. A manifestation we saw in production was:

6. In update_entity_lag(), se->slice is used to calculate limit, which
ends up as a huge negative number.
7. limit is used in se->vlag = clamp(vlag, -limit, limit). Because limit
is negative, vlag > limit, so se->vlag is set to the same huge
negative number.
8. In place_entity(), se->vlag is scaled, which overflows and results in
another huge (positive or negative) number.
9. The adjusted lag is subtracted from se->vruntime, which increases or
decreases se->vruntime by a huge number.
10. pick_eevdf() calls entity_eligible()/vruntime_eligible(), which
incorrectly returns false because the vruntime is so far from the
other vruntimes on the queue, causing the
(vruntime - cfs_rq->min_vruntime) * load calulation to overflow.
11. Nothing appears to be eligible, so pick_eevdf() returns NULL.
12. pick_next

Affected

11 ranges

Vendor	Product	Version range	Fixed in
debian	linux	< linux 6.12.29-1 (forky)	linux 6.12.29-1 (forky)
linux	linux	—	—
linux	linux	>= aef6987d89544d63a47753cf3741cabff0b5574c < 86b37810fa1e40b93171da023070b99ccbb4ea04	86b37810fa1e40b93171da023070b99ccbb4ea04
linux	linux	>= aef6987d89544d63a47753cf3741cabff0b5574c < 50a665496881262519f115f1bfe5822f30580eb0	50a665496881262519f115f1bfe5822f30580eb0
linux	linux	>= aef6987d89544d63a47753cf3741cabff0b5574c < bbce3de72be56e4b5f68924b7da9630cc89aa1a8	bbce3de72be56e4b5f68924b7da9630cc89aa1a8
linux	linux_kernel	—	—
linux	linux_kernel	>= 0 < 6.12.29-1	6.12.29-1
linux	linux_kernel	>= 0 < 6.12.29-1	6.12.29-1
linux	linux_kernel	>= 0 < 6.14.0-22.22	6.14.0-22.22
linux	linux_kernel	>= 6.12 < 6.12.29	6.12.29
linux	linux_kernel	>= 6.13 < 6.14.5	6.14.5

CVSS provenance

nvd v3.1 5.5 MEDIUM CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

osv 5.5 MEDIUM

vendor_debian 5.5 LOW

vendor_redhat 5.5 MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-476 CWE-190