Security readout for executives and security teams
Plain-English summary
A Linux traffic-control flaw can let unsafe SFQ parameter combinations bypass an early validation check, leading to an out-of-bounds kernel access and crash. The supplied CVSS rates potential confidentiality, integrity, and availability impact as high, but the concrete evidence provided is a syzkaller-generated crash rather than demonstrated compromise.
Executive priority
Treat this as a high-priority local kernel issue, especially on shared or multi-tenant systems with delegated network administration. Patch through supported distribution channels promptly. Emergency internet-facing containment is not justified by the supplied evidence because the vulnerability is local and active exploitation is unconfirmed.
Technical view
SFQ configuration values could indirectly change the queue limit after it was validated. This allowed an invalid internal index, with syzkaller observing index 65535 against a 128-element sfq_head array during queue reset. Stable-kernel commits move validation to the end of configuration processing so derived values are checked.
Likely exposure
Exposure is limited to Linux systems running an affected kernel where a local actor can modify SFQ traffic-control configuration. The source bundle identifies affected release and commit data, but its version presentation is insufficient for confidently mapping every distribution package. Internet reachability alone does not establish exposure.
Exploitation context
The CVSS vector describes a local, low-complexity, low-privilege attack requiring no user interaction. The supplied evidence demonstrates a syzkaller-triggered kernel crash. The CVE is not marked as KEV, and no cited source reports active exploitation or a weaponized exploit.
Researcher notes
The strongest demonstrated outcome is an array-index-out-of-bounds condition in sch_sfq.c during reset or dequeue processing. The supplied CVSS asserts broader security impact, but no source demonstrates privilege escalation, code execution, or data compromise. Version applicability should be verified through distribution package metadata and the referenced stable commits.
Mitigation direction
- Install a vendor-supported kernel containing the applicable stable-kernel fix.
- Consult your Linux distributor's advisory for package-specific fixed versions.
- Restrict untrusted users and workloads from changing traffic-control qdisc configuration.
- Prioritize shared hosts where delegated workloads can administer network settings.
Validation and detection
- Inventory kernel versions across Linux hosts and container platforms.
- Map installed distribution packages against vendor advisories and fixed builds.
- Identify systems permitting non-administrators or workloads to configure SFQ qdiscs.
- Confirm the applicable stable fix is present after updating.
- Monitor affected systems for kernel out-of-bounds or SFQ-related crash reports.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-37752 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/8fadc871a42933aacb7f1ce9ed9a96485e2c9cf4CVE reference, Linux
- https://git.kernel.org/stable/c/7d62ded97db6b7c94c891f704151f372b1ba4688CVE reference, Linux
- https://git.kernel.org/stable/c/6c589aa318023690f1606c666a7fb5f4c1c9c219CVE reference, Linux
- https://git.kernel.org/stable/c/1348214fa042a71406964097e743c87a42c85a49CVE reference, Linux
- https://git.kernel.org/stable/c/d2718324f9e329b10ddc091fba5a0ba2b9d4d96aCVE reference, Linux
- https://git.kernel.org/stable/c/f86293adce0c201cfabb283ef9d6f21292089bb8CVE reference, Linux
- https://git.kernel.org/stable/c/5e5e1fcc1b8ed57f902c424c5d9b328a3a19073dCVE reference, Linux
- https://git.kernel.org/stable/c/b36a68192037d1614317a09b0d78c7814e2eecf9CVE reference, Linux
- https://git.kernel.org/stable/c/b3bf8f63e6179076b57c9de660c9f80b5abefe70CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/05/msg00045.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.