CVE-2025-21653

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.6.74

Description A vulnerability in the Linux kernel has been resolved, specifically in the net sched: cls flow component, where the TCA FLOW RSHIFT attribute was not validated. This could lead to undefined behavior when right-shifting a 32-bit integer with large shift values. The issue was discovered by syzbot and is related to a shift-out-of-bounds error in the net/sched/cls flow.c file. The vulnerability affects the flow classify function and can be triggered through the tc classify function.

Recommendations To resolve the issue, update the Linux kernel to version 6.6.74 or later. As a temporary workaround, consider restricting access to the vulnerable flow classify() function until a patch is available. Avoid using the TCA FLOW RSHIFT attribute in the affected API endpoint until the issue is resolved.