Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2025-68325

net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop In cake_drop(), qdisc_tree_reduce_backlog() is used to update the qlen and backlog of the qdisc hierarchy. Its caller, cake_enqueue(), assumes that the parent qdisc will enqueue the current packet. However, this assumption breaks when cake_enqueue() returns NET_XMIT_CN: the parent qdisc stops enqueuing current packet, leaving the tree qlen/backlog accounting inconsistent. This mismatch can lead to a NULL dereference (e.g., when the parent Qdisc is qfq_qdisc). This patch computes the qlen/backlog delta in a more robust way by observing the difference before and after the series of cake_drop() calls, and then compensates the qdisc tree accounting if cake_enqueue() returns NET_XMIT_CN. To ensure correct compensation when ACK thinning is enabled, a new variable is introduced to keep qlen unchanged.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • de04ddd2980b48caa8d7e24a7db2742917a8b280 to < a3f4e3de41a3f115db35276c6b186ccbc913934aaffected
  • 0dacfc5372e314d1219f03e64dde3ab495a5a25e to < 38abf6e931b169ea88d7529b49096f53a5dcf8feaffected
  • 710866fc0a64eafcb8bacd91bcb1329eb7e5035f to < fcb91be52eb6e92e00b533ebd7c77fecada537e1affected
  • aa12ee1c1bd260943fd6ab556d8635811c332eeb to < d01f0e072dadb02fe10f436b940dd957aff0d7d4affected
  • ff57186b2cc39766672c4c0332323933e5faaa88 to < 0b6216f9b3d1c33c76f74511026e5de5385ee520affected
  • 15de71d06a400f7fdc15bf377a2552b0ec437cf5 to < 529c284cc2815c8350860e9a31722050fe7117cbaffected
  • 15de71d06a400f7fdc15bf377a2552b0ec437cf5 to < 3ed6c458530a547ed0c9ea0b02b19bab620be88baffected
  • 15de71d06a400f7fdc15bf377a2552b0ec437cf5 to < 9fefc78f7f02d71810776fdeb119a05a946a27ccaffected
  • 7689ab22de36f8db19095f6bdf11f28cfde92f5caffected
  • 62d591dde4defb1333d202410609c4ddeae060b3affected
  • 5.10.241 to < 5.10.248affected
  • 5.15.190 to < 5.15.198affected
  • 6.1.149 to < 6.1.160affected
  • 6.6.103 to < 6.6.120affected
  • 6.12.44 to < 6.12.63affected
  • 5.4.297 to < 5.5affected
  • 6.16.4 to < 6.17affected

Linux Linux

Default version status: affected

  • 6.17affected
  • 0 to < 6.17unaffected
  • 5.10.248 to ≤ 5.10.*unaffected
  • 5.15.198 to ≤ 5.15.*unaffected
  • 6.1.160 to ≤ 6.1.*unaffected
  • 6.6.120 to ≤ 6.6.*unaffected
  • 6.12.63 to ≤ 6.12.*unaffected
  • 6.17.13 to ≤ 6.17.*unaffected
  • 6.18.2 to ≤ 6.18.*unaffected
  • 6.19 to ≤ *unaffected

References