CVE-2025-39677 net/sched: Fix backlog accounting in qdisc_dequeue_internal

In the Linux kernel, the following vulnerability has been resolved: net/sched: Fix backlog accounting in qdiscdequeueinternal This issue applies for the following qdiscs: hhf, fq, fqcodel, and fqpie, and occurs in their change handlers when adjusting to the new limit. The problem is the following...

CVE-2025-39677

CVE-2025-39677: In the Linux kernel, backlog accounting was fixed for qdisc_dequeue_internal affecting tbf-backed qdiscs (hhf, fq, fq_codel, fq_pie). The root cause was that when dropping packets to satisfy a new limit, only qlen was accounted for for some cases (gso_skb path), omitting qdisc_qst...

CVE-2025-39677: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net/sched: Fix backlog accounting in qdiscdequeueinternal This issue applies for the following qdiscs: hhf, fq, fqcodel, and fqpie, and occurs in their change handlers when adjusting to the new limit. The problem is the following...

Malicious code in @zalastax/nolb-fq (npm)

The package @zalastax/nolb-fq was found to contain malicious code...

MAL-2025-11488 Malicious code in @zalastax/nolb-fq (npm)

The package @zalastax/nolb-fq was found to contain malicious code...

Linux Distros Unpatched Vulnerability : CVE-2021-47175

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: net/sched: fqpie: fix OOB access in the traffic path the following script: tc qdisc add dev...

UBUNTU-CVE-2025-37798

In the Linux kernel, the following vulnerability has been resolved: codel: remove sch-q.qlen check before qdisctreereducebacklog After making all -qlennotify callbacks idempotent, now it is safe to remove the check of qlen!=0 from both fqcodeldequeue and codelqdiscdequeue...

PT-2025-27950

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The issue concerns the hfsc qlen notify function in the Linux kernel, which is not idempotent and can cause problems for its callers, such as fq codel dequeue. To address this, changes...

kernel: net: avoid potential underflow in qdisc_pkt_len_init() with UFO

A flaw was found in the Linux kernel's network handling. A local user could craft a specific Generic Segmentation Offload GSO packet with UDP Fragmentation Offload UFO characteristics. This crafted packet could lead to an underflow in the qdiscpktleninit function, causing a kernel NULL pointer...

GHSA-7WRW-R4P8-38RX vulnerabilities

Vulnerabilities for packages: flux-image-automation-controller, cfssl, redka, ctop, elvish, vertical-pod-autoscaler, volume-modifier-for-k8s, prometheus-adapter, kapp, dask-gateway, go-bindata, actions-runner-controller, kuberlr, k8ssandra-client, flux-notification-controller, kubewatch, mkcert,...

Security update for iperf

This update for iperf fixes the following issues: update to 3.17.1 bsc1224262, CVE-2024-26306: BREAKING CHANGE: iperf3's authentication features, when used with OpenSSL prior to 3.2.0, contain a vulnerability to a side-channel timing attack. To address this flaw, a change has been made to the...

DEBIAN-CVE-2024-50206

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtkethsoc: fix memory corruption during fq dma init The loop responsible for allocating up to MTKFQDMALENGTH buffers must only touch as many descriptors, otherwise it ends up corrupting unrelated memory. Fix the lo...

CVE-2024-50206

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtkethsoc: fix memory corruption during fq dma init The loop responsible for allocating up to MTKFQDMALENGTH buffers must only touch as many descriptors, otherwise it ends up corrupting unrelated memory. Fix the lo...

CVE-2024-50206: Out-of-bounds Write

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtkethsoc: fix memory corruption during fq dma init The loop responsible for allocating up to MTKFQDMALENGTH buffers must only touch as many descriptors, otherwise it ends up corrupting unrelated memory. Fix the lo...

CVE-2024-44337 vulnerabilities

Vulnerabilities for packages: fq, kube-metrics-adapter...

PT-2024-34041

Name of the Vulnerable Software and Affected Versions: Linux Kernel affected versions not specified Description: A memory corruption issue has been identified in the Linux kernel's Ethernet driver initialization, specifically in the mtk eth soc component. The problem occurs during the FQ DMA...

PT-2024-33791

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.6.58 Description: The issue is related to a potential underflow in the qdisc pkt len init function when handling UFO UDP Fragmentation Offload packets. This occurs after specific commits that introduced sanity...

UBUNTU-CVE-2024-42114

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: restrict NL80211ATTRTXQQUANTUM values syzbot is able to trigger softlockups, setting NL80211ATTRTXQQUANTUM to 2^31. We had a similar issue in schfq, fixed with commit d9e15a273306 "pktsched: fq: do not accept sill...

Malicious code in fq-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2ce1fb799433153eff547fb7ee245b4f7d0e230c86476ddd6ec16bbb7638abc0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-2393 Malicious code in fq-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2ce1fb799433153eff547fb7ee245b4f7d0e230c86476ddd6ec16bbb7638abc0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...