CVE-2025-38568

In the Linux kernel, the following vulnerability has been resolved:

net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing

TCA_MQPRIO_TC_ENTRY_INDEX is validated using NLA_POLICY_MAX(NLA_U32, TC_QOPT_MAX_QUEUE), which allows the value TC_QOPT_MAX_QUEUE (16). This leads to a 4-byte out-of-bounds stack write in the fp[] array, which only has room for 16 elements (0–15).

Fix this by changing the policy to allow only up to TC_QOPT_MAX_QUEUE - 1.

A bounds-check bug in mqprio TC entry parsing allows a 4-byte stack out-of-bounds write when TCA_MQPRIO_TC_ENTRY_INDEX equals 16, causing kernel crashes. Exploitation requires local netlink access with CAP_NET_ADMIN (often within the relevant network namespace). No practical confidentiality or integrity impact is evident due to tight value constraints enforced by the netlink policy.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.