Linux kernel (net/sched SFQ): Missing limit validation in sch_sfq - out-of-bounds write

CVSS 6.3CVE-2025-37752Kernel, userspace & hypervisorcurated

Impact

Missing limit validation in sch_sfq - out-of-bounds write

Who can reach it

Any tenant process in a container with CAP_NET_ADMIN in a userns

What to do

Livepatchable; otherwise drain + reboot

References

https://access.redhat.com/security/cve/CVE-2025-37752

Related entries

libssh SCP client: malicious server can write files outside the client's working directoryCVE-2026-0964 · libssh SCP client (server-supplied path handling)Medium
Linux kernel (drivers/pci/hotplug): A power fault on a PCIe hotplug slot latches a sticky status bit that the hardirqCVE-2021-47617 · Linux kernel (drivers/pci/hotplug)Medium
Linux kernel (drivers/iommu/arm/arm-smmu-v3): A process using SVA that unmaps memory drives a flood of SMMU rangeCVE-2023-52484 · Linux kernel (drivers/iommu/arm/arm-smmu-v3)Medium
QEMU e1000: guest-triggered stack overflow in the loopback receive path crashes the host QEMU processCVE-2025-12464 · QEMU e1000 network device (e1000_receive_iov loopback path)Medium
Linux kernel (drivers/iommu): The ARM long-descriptor unmap path returns a negative errno through an unsigned size_tCVE-2026-23067 · Linux kernel (drivers/iommu)Medium
Linux kernel (drivers/pci): Tearing down a PF that still has SR-IOV VFs takes pci_rescan_remove_lock recursively andCVE-2026-43147 · Linux kernel (drivers/pci)Medium

All Kernel, userspace & hypervisor entries

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.