CVE-2025-21965

Published: Apr 1, 2025Modified: Jun 17, 2026

5.5

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Exploitability: 1.8 / Impact: 3.6

Source: NVD

Description

In the Linux kernel, the following vulnerability has been resolved: sched_ext: Validate prev_cpu in scx_bpf_select_cpu_dfl() If a BPF scheduler provides an invalid CPU (outside the nr_cpu_ids range) as prev_cpu to scx_bpf_select_cpu_dfl() it can cause a kernel crash. To prevent this, validate prev_cpu in scx_bpf_select_cpu_dfl() and trigger an scx error if an invalid CPU is specified.

Affected (8)

Products: Linux: Linux Kernel

Linux

1 product

Linux Kernel

Configuration A

8 vulnerable

Vulnerable Software	Affected Versions
Linux Linux Kernel	From 6.12 to 6.12.20
Linux Linux Kernel	From 6.13 to 6.13.8
Linux Linux Kernel	Version 6.14 rc1
Linux Linux Kernel	Version 6.14 rc2
Linux Linux Kernel	Version 6.14 rc3
Linux Linux Kernel	Version 6.14 rc4
Linux Linux Kernel	Version 6.14 rc5
Linux Linux Kernel	Version 6.14 rc6

Related CWEs

CWE-476

NULL Pointer Dereference

The product dereferences a pointer that it expects to be valid but is NULL.

References (3)

https://git.kernel.org/stable/c/515680e76c536dd4aa8e2b5d674b0d441baddf5b

Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Patch

https://git.kernel.org/stable/c/752b56bb76e2471197d25d6948d85753043b10da

Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Patch

https://git.kernel.org/stable/c/9360dfe4cbd62ff1eb8217b815964931523b75b3

Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Patch

Timeline

No history available yet.