CVE-2025-21653

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net_sched: cls_flow: validate TCA_FLOW_RSHIFT attribute

syzbot found that TCA_FLOW_RSHIFT attribute was not validated.

Right shitfing a 32bit integer is undefined for large shift values.

UBSAN: shift-out-of-bounds in net/sched/cls_flow.c:329:23

shift exponent 9445 is too large for 32-bit type 'u32' (aka 'unsigned int')

CPU: 1 UID: 0 PID: 54 Comm: kworker/u8:3 Not tainted 6.13.0-rc3-syzkaller-00180-g4f619d518db9 #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024

Workqueue: ipv6_addrconf addrconf_dad_work

Call Trace:

<TASK>

__dump_stack lib/dump_stack.c:94 [inline]

dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120

ubsan_epilogue lib/ubsan.c:231 [inline]

__ubsan_handle_shift_out_of_bounds+0x3c8/0x420 lib/ubsan.c:468

flow_classify+0x24d5/0x25b0 net/sched/cls_flow.c:329

tc_classify include/net/tc_wrapper.h:197 [inline]

__tcf_classify net/sched/cls_api.c:1771 [inline]

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References