Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

CVE-2025-21653— net_sched: cls_flow: validate TCA_FLOW_RSHIFT attribute

EPSS 0.03% · P8

Affected Version Matrix 16

VendorProductVersion RangeStatus
LinuxLinuxe5dfb815181fcb186d6080ac3a091eadff2d98fe< 9858f4afeb2e59506e714176bd3e135539a3eeecaffected
e5dfb815181fcb186d6080ac3a091eadff2d98fe< 43658e4a5f2770ad94e93362885ff51c10cf3179affected
e5dfb815181fcb186d6080ac3a091eadff2d98fe< a313d6e6d5f3a631cae5a241c392c28868aa5c5eaffected
e5dfb815181fcb186d6080ac3a091eadff2d98fe< 2011749ca96460386844dfc7e0fde53ebee96f3caffected
e5dfb815181fcb186d6080ac3a091eadff2d98fe< e54beb9aed2a90dddf4c5d68fcfc9a01f3e40a61affected
e5dfb815181fcb186d6080ac3a091eadff2d98fe< 6fde663f7321418996645ee602a473457640542faffected
e5dfb815181fcb186d6080ac3a091eadff2d98fe< a039e54397c6a75b713b9ce7894a62e06956aa92affected
2.6.25affected
… +8 more rows
Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2025-21653

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
net_sched: cls_flow: validate TCA_FLOW_RSHIFT attribute
Source: NVD (National Vulnerability Database)
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: net_sched: cls_flow: validate TCA_FLOW_RSHIFT attribute syzbot found that TCA_FLOW_RSHIFT attribute was not validated. Right shitfing a 32bit integer is undefined for large shift values. UBSAN: shift-out-of-bounds in net/sched/cls_flow.c:329:23 shift exponent 9445 is too large for 32-bit type 'u32' (aka 'unsigned int') CPU: 1 UID: 0 PID: 54 Comm: kworker/u8:3 Not tainted 6.13.0-rc3-syzkaller-00180-g4f619d518db9 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Workqueue: ipv6_addrconf addrconf_dad_work Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 ubsan_epilogue lib/ubsan.c:231 [inline] __ubsan_handle_shift_out_of_bounds+0x3c8/0x420 lib/ubsan.c:468 flow_classify+0x24d5/0x25b0 net/sched/cls_flow.c:329 tc_classify include/net/tc_wrapper.h:197 [inline] __tcf_classify net/sched/cls_api.c:1771 [inline] tcf_classify+0x420/0x1160 net/sched/cls_api.c:1867 sfb_classify net/sched/sch_sfb.c:260 [inline] sfb_enqueue+0x3ad/0x18b0 net/sched/sch_sfb.c:318 dev_qdisc_enqueue+0x4b/0x290 net/core/dev.c:3793 __dev_xmit_skb net/core/dev.c:3889 [inline] __dev_queue_xmit+0xf0e/0x3f50 net/core/dev.c:4400 dev_queue_xmit include/linux/netdevice.h:3168 [inline] neigh_hh_output include/net/neighbour.h:523 [inline] neigh_output include/net/neighbour.h:537 [inline] ip_finish_output2+0xd41/0x1390 net/ipv4/ip_output.c:236 iptunnel_xmit+0x55d/0x9b0 net/ipv4/ip_tunnel_core.c:82 udp_tunnel_xmit_skb+0x262/0x3b0 net/ipv4/udp_tunnel_core.c:173 geneve_xmit_skb drivers/net/geneve.c:916 [inline] geneve_xmit+0x21dc/0x2d00 drivers/net/geneve.c:1039 __netdev_start_xmit include/linux/netdevice.h:5002 [inline] netdev_start_xmit include/linux/netdevice.h:5011 [inline] xmit_one net/core/dev.c:3590 [inline] dev_hard_start_xmit+0x27a/0x7d0 net/core/dev.c:3606 __dev_queue_xmit+0x1b73/0x3f50 net/core/dev.c:4434
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于cls_flow模块未验证TCA_FLOW_RSHIFT属性，可能导致移位操作超出范围。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

VendorProductAffected VersionsCPESubscribe
LinuxLinux e5dfb815181fcb186d6080ac3a091eadff2d98fe ~ 9858f4afeb2e59506e714176bd3e135539a3eeec -
LinuxLinux 2.6.25 -

II. Public POCs for CVE-2025-21653

#POC DescriptionSource LinkShenlong Link
AI-Generated POCPremium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2025-21653

请登录查看更多情报信息。

Same Patch Batch · Linux · 2025-01-19 · 47 CVEs total

CVE-2024-57916misc: microchip: pci1xxxx: Resolve kernel panic during GPIO IRQ handling
CVE-2024-57918drm/amd/display: fix page fault due to max surface definition mismatch
CVE-2024-57921drm/amdgpu: Add a lock when accessing the buddy trim function
CVE-2024-57925ksmbd: fix a missing return value check bug
CVE-2024-57926drm/mediatek: Set private->all_drm_private[i]->drm to NULL if mtk_drm_bind returns err
CVE-2024-57928netfs: Fix enomem handling in buffered reads
CVE-2024-57927nfs: Fix oops in nfs_netfs_init_request() when copying to cache
CVE-2024-57929dm array: fix releasing a faulty array block twice in dm_array_cursor_end
CVE-2024-57923btrfs: zlib: fix avail_in bytes for s390 zlib HW compression path
CVE-2024-57917topology: Keep the cpumask unchanged when printing cpumap
CVE-2024-57919drm/amd/display: fix divide error in DM plane scale calcs
CVE-2024-57914usb: typec: tcpci: fix NULL pointer issue on shared irq case
CVE-2024-57913usb: gadget: f_fs: Remove WARN_ON in functionfs_bind
CVE-2024-57912iio: pressure: zpa2326: fix information leak in triggered buffer
CVE-2024-57911iio: dummy: iio_simply_dummy_buffer: fix information leak in triggered buffer
CVE-2024-57910iio: light: vcnl4035: fix information leak in triggered buffer
CVE-2024-57908iio: imu: kmx61: fix information leak in triggered buffer
CVE-2024-57909iio: light: bh1745: fix information leak in triggered buffer
CVE-2024-57907iio: adc: rockchip_saradc: fix information leak in triggered buffer
CVE-2024-57905iio: adc: ti-ads1119: fix information leak in triggered buffer

Showing top 20 of 47 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2025-21653

No comments yet

Leave a comment