CVE-2025-38568

What it actually does

Out-of-bounds stack write in the fp[] array (size 16) when TCA_MQPRIO_TC_ENTRY_INDEX is set to TC_QOPT_MAX_QUEUE (16) due to NLA_POLICY_MAX validation allowing an index one past the end of the array during tc mqprio entry parsing.

Why it matters to the business

Kernel memory corruption risk in Linux networking traffic control that can lead to system crashes, denial of service, or local privilege escalation, particularly impacting containerized and cloud environments using advanced qdisc configurations; high downstream kernel prevalence increases exposure for affected distributions.

How an attack unfolds

An attacker with local access sends a crafted netlink message to the mqprio qdisc using TCA_MQPRIO_TC_ENTRY_INDEX set to 16, triggering the 4-byte out-of-bounds write in the kernel stack; observed threat actor activity around Linux kernel privilege escalation on Container-Optimized OS indicates this class of flaw has been chained for container escape or root access.

How to fix it

Apply the upstream fix in commit 39491e859fd494d0b51adc5c7d54c8a7dcf1d198 or upgrade affected packages to openjdk-8-openj9 (Chainguard) 0.53.0-r1 and equivalent fixed versions; rebuild and reboot into the patched kernel.

How to confirm the fix worked

Verify the running kernel contains commit 39491e859fd494d0b51adc5c7d54c8a7dcf1d198 or package versions at 0.53.0-r1; test mqprio qdisc creation with index 16 to confirm it is now rejected.

Typical attack path

1. Obtain local unprivileged access on a Linux host
2. Craft malicious netlink attributes for TCA_MQPRIO_TC_ENTRY with index 16
3. Invoke tc command or equivalent netlink call to install mqprio qdisc
4. Trigger the OOB write during entry parsing
5. Exploit resulting memory corruption for privilege escalation or DoS

How to detect it

Review kernel audit logs and netlink traces for mqprio qdisc creation attempts with TCA_MQPRIO_TC_ENTRY_INDEX values at or above 16; correlate with privilege-escalation indicators on Container-Optimized OS hosts.

What your security team should do

• Prioritize kernel updates on all systems exposing advanced traffic control or running in container-optimized environments within the next 30 days
• Audit and restrict unprivileged use of tc and netlink qdisc configuration where possible
• Monitor for new exploit maturity given ongoing Linux kernel privilege-escalation campaigns
• Rebuild container images against the fixed kernel and OpenJDK packages