CVE-2025-21965 (GCVE-0-2025-21965)

Vulnerability from cvelistv5 – Published: 2025-04-01 15:47 – Updated: 2026-08-05 11:55
VLAI
Title
sched_ext: Validate prev_cpu in scx_bpf_select_cpu_dfl()
Summary
In the Linux kernel, the following vulnerability has been resolved: sched_ext: Validate prev_cpu in scx_bpf_select_cpu_dfl() If a BPF scheduler provides an invalid CPU (outside the nr_cpu_ids range) as prev_cpu to scx_bpf_select_cpu_dfl() it can cause a kernel crash. To prevent this, validate prev_cpu in scx_bpf_select_cpu_dfl() and trigger an scx error if an invalid CPU is specified.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: f0e1a0643a59bf1f922fa209cec86a170b784f3f , < 752b56bb76e2471197d25d6948d85753043b10da (git)
Affected: f0e1a0643a59bf1f922fa209cec86a170b784f3f , < 515680e76c536dd4aa8e2b5d674b0d441baddf5b (git)
Affected: f0e1a0643a59bf1f922fa209cec86a170b784f3f , < 9360dfe4cbd62ff1eb8217b815964931523b75b3 (git)
Create a notification for this product.
Linux Linux Affected: 6.12
Unaffected: 0 , < 6.12 (semver)
Unaffected: 6.12.20 , ≤ 6.12.* (semver)
Unaffected: 6.13.8 , ≤ 6.13.* (semver)
Unaffected: 6.14 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/sched/ext.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "752b56bb76e2471197d25d6948d85753043b10da",
              "status": "affected",
              "version": "f0e1a0643a59bf1f922fa209cec86a170b784f3f",
              "versionType": "git"
            },
            {
              "lessThan": "515680e76c536dd4aa8e2b5d674b0d441baddf5b",
              "status": "affected",
              "version": "f0e1a0643a59bf1f922fa209cec86a170b784f3f",
              "versionType": "git"
            },
            {
              "lessThan": "9360dfe4cbd62ff1eb8217b815964931523b75b3",
              "status": "affected",
              "version": "f0e1a0643a59bf1f922fa209cec86a170b784f3f",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/sched/ext.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.12"
            },
            {
              "lessThan": "6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.20",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.14",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.20",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.8",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsched_ext: Validate prev_cpu in scx_bpf_select_cpu_dfl()\n\nIf a BPF scheduler provides an invalid CPU (outside the nr_cpu_ids\nrange) as prev_cpu to scx_bpf_select_cpu_dfl() it can cause a kernel\ncrash.\n\nTo prevent this, validate prev_cpu in scx_bpf_select_cpu_dfl() and\ntrigger an scx error if an invalid CPU is specified."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable kfunc is only reachable from a sched_ext BPF scheduler attached via the bpf() syscall and struct_ops link, executed in local task-wakeup context. No remote or adjacent peer supplies data to this path, matching the guidance that BPF/scheduler bugs are Local.\nAC:L - The attacker directly supplies the out-of-range prev_cpu as a plain scalar argument to scx_bpf_select_cpu_dfl(); the BPF verifier does not range-check kfunc scalar arguments, so the OOB access is fully deterministic. There is no race, no memory-layout dependency, and no state outside the attacker\u0027s control.\nPR:L - Loading the sched_ext struct_ops program nominally requires CAP_BPF/CAP_PERFMON, but BPF token delegation (bpffs delegate_progs=struct_ops) grants exactly these inside a user namespace, and sched_ext\u0027s pervasive ops_cpu_valid()/scx_kf_allowed() validation exists precisely because the BPF scheduler is treated as an untrusted, containable component whose bad input must not corrupt the kernel. This matches the scoring of the directly analogous CVE-2025-38012 in the same subsystem.\nUI:N - The invalid CPU is passed during ordinary task wakeup processing driven by the attacker\u0027s own workload; no victim action such as mounting a filesystem or opening a file is required.\nS:U - The out-of-bounds reads and the bit-clear write both land in kernel memory within the same security authority as the running kernel. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - per_cpu(sd_numa/sd_llc/sd_llc_id, prev_cpu) and cpu_smt_mask(prev_cpu) index __per_cpu_offset[] with an attacker-chosen s32, yielding an out-of-bounds read that produces a wild base pointer which is then dereferenced by cpumask_intersects()/cpumask_andnot(). This is an unbounded arbitrary kernel read whose results steer subsequent behavior.\nI:H - cpumask_test_and_clear_cpu(prev_cpu, idle_masks.cpu) resolves to test_and_clear_bit() with no effective bounds check outside CONFIG_DEBUG_PER_CPU_MAPS, giving an out-of-bounds write that clears any single bit at an attacker-chosen offset (up to ~512 MB via the int-to-unsigned conversion), plus __cpumask_clear_cpu()/cpumask_andnot() writes driven by the wild sibling mask. A controlled bit-clear primitive over adjacent heap/percpu structures is exploitable for privilege escalation and control-flow corruption.\nA:H - The commit states outright that an invalid prev_cpu \"can cause a kernel crash\" \u2014 the wild per-cpu pointer dereference and the far out-of-bounds bit access reliably oops or panic the kernel. Any resulting corruption of the scheduler\u0027s idle masks additionally destabilizes CPU selection system-wide."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:55:41.135Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/752b56bb76e2471197d25d6948d85753043b10da"
        },
        {
          "url": "https://git.kernel.org/stable/c/515680e76c536dd4aa8e2b5d674b0d441baddf5b"
        },
        {
          "url": "https://git.kernel.org/stable/c/9360dfe4cbd62ff1eb8217b815964931523b75b3"
        }
      ],
      "title": "sched_ext: Validate prev_cpu in scx_bpf_select_cpu_dfl()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-21965",
    "datePublished": "2025-04-01T15:47:01.129Z",
    "dateReserved": "2024-12-29T08:45:45.796Z",
    "dateUpdated": "2026-08-05T11:55:41.135Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-21965",
      "date": "2026-08-05",
      "epss": "0.00187",
      "percentile": "0.08568"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-21965\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-04-01T16:15:27.767\",\"lastModified\":\"2026-07-30T06:22:00.100\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nsched_ext: Validate prev_cpu in scx_bpf_select_cpu_dfl()\\n\\nIf a BPF scheduler provides an invalid CPU (outside the nr_cpu_ids\\nrange) as prev_cpu to scx_bpf_select_cpu_dfl() it can cause a kernel\\ncrash.\\n\\nTo prevent this, validate prev_cpu in scx_bpf_select_cpu_dfl() and\\ntrigger an scx error if an invalid CPU is specified.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: sched_ext: Validar prev_cpu en scx_bpf_select_cpu_dfl(). Si un programador BPF proporciona una CPU no v\u00e1lida (fuera del rango nr_cpu_ids) como prev_cpu a scx_bpf_select_cpu_dfl(), puede provocar un fallo del kernel. Para evitarlo, valide prev_cpu en scx_bpf_select_cpu_dfl() y genere un error scx si se especifica una CPU no v\u00e1lida.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"kernel/sched/ext.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"f0e1a0643a59bf1f922fa209cec86a170b784f3f\",\"lessThan\":\"752b56bb76e2471197d25d6948d85753043b10da\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f0e1a0643a59bf1f922fa209cec86a170b784f3f\",\"lessThan\":\"515680e76c536dd4aa8e2b5d674b0d441baddf5b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f0e1a0643a59bf1f922fa209cec86a170b784f3f\",\"lessThan\":\"9360dfe4cbd62ff1eb8217b815964931523b75b3\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"kernel/sched/ext.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.12\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.12\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.20\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.13.8\",\"lessThanOrEqual\":\"6.13.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.14\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.12\",\"versionEndExcluding\":\"6.12.20\",\"matchCriteriaId\":\"F6AE02FC-5B2D-426A-B8D7-3D71FBE28D40\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.13.8\",\"matchCriteriaId\":\"0A20D4D7-B329-4C68-B662-76062EA7DCF0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.14:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"186716B6-2B66-4BD0-852E-D48E71C0C85F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.14:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"0D3E781C-403A-498F-9DA9-ECEE50F41E75\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.14:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"66619FB8-0AAF-4166-B2CF-67B24143261D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.14:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"D3D6550E-6679-4560-902D-AF52DCFE905B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.14:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"45B90F6B-BEC7-4D4E-883A-9DBADE021750\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.14:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"1759FFB7-531C-41B1-9AE1-FD3D80E0D920\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/515680e76c536dd4aa8e2b5d674b0d441baddf5b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/752b56bb76e2471197d25d6948d85753043b10da\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9360dfe4cbd62ff1eb8217b815964931523b75b3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-30T10:15:33+00:00",
      "cve": "CVE-2025-21965",
      "id": "CVE-2025-21965",
      "initial_release_date": "2025-04-01T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: sched_ext: Validate prev_cpu in scx_bpf_select_cpu_dfl()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-21965.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-25T01:01:58Z",
      "cve": "CVE-2025-21965",
      "id": "CVE-2025-21965",
      "initial_release_date": "2025-04-05T02:25:23Z",
      "product_status:known_not_affected": "384",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-21965",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-21965.json",
      "version": "9"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.