CVE-2025-37890 net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc

In the Linux kernel, the following vulnerability has been resolved: netsched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc As described in Gerrard's report 1, we have a UAF case when an hfsc class has a netem child qdisc. The crux of the issue is that hfsc is assuming that...

CVE-2025-37890 net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc

In the Linux kernel, the following vulnerability has been resolved: netsched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc As described in Gerrard's report 1, we have a UAF case when an hfsc class has a netem child qdisc. The crux of the issue is that hfsc is assuming that...

kernel: net/sched: accept TCA_STAB only for root qdisc

In the Linux kernel, the following vulnerability has been resolved: net/sched: accept TCASTAB only for root qdisc Most qdiscs maintain their backlog using qdiscpktlenskb on the assumption it is invariant between the enqueue and dequeue handlers. Unfortunately syzbot can crash a host rather easily...

kernel: net: sched: fix ordering of qlen adjustment

In the Linux kernel, the following vulnerability has been resolved: net: sched: fix ordering of qlen adjustment Changes to sch-q.qlen around qdisctreereducebacklog need to happen before a call to said function because otherwise it may fail to notify parent qdiscs when the child is about to become...

kernel: net: add more sanity checks to qdisc_pkt_len_init()

In the Linux kernel, the following vulnerability has been resolved: net: add more sanity checks to qdiscpktleninit One path takes care of SKBGSODODGY, assuming skb-len is bigger than hdrlen. virtionethdrtoskb does not fully dissect TCP headers, it only make sure it is at least 20 bytes. It is...

PT-2025-22889

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue concerns a NULL pointer dereference in the Linux kernel's net sched component. When reducing a qdisc's limit via the -change operation, only the main skb queue was trimmed,...

SUSE CVE-2025-37798

In the Linux kernel, the following vulnerability has been resolved: codel: remove sch-q.qlen check before qdisctreereducebacklog After making all -qlennotify callbacks idempotent, now it is safe to remove the check of qlen!=0 from both fqcodeldequeue and codelqdiscdequeue...

CBL Mariner 2.0 Security Update: kernel (CVE-2025-21700)

The version of kernel installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-21700 advisory. - In the Linux kernel, the following vulnerability has been resolved: net: sched: Disallow replacing of child...

UBUNTU-CVE-2025-37797

In the Linux kernel, the following vulnerability has been resolved: netsched: hfsc: Fix a UAF vulnerability in class handling This patch fixes a Use-After-Free vulnerability in the HFSC qdisc class handling. The issue occurs due to a time-of-check/time-of-use condition in hfscchangeclass when...

UBUNTU-CVE-2025-37798

In the Linux kernel, the following vulnerability has been resolved: codel: remove sch-q.qlen check before qdisctreereducebacklog After making all -qlennotify callbacks idempotent, now it is safe to remove the check of qlen!=0 from both fqcodeldequeue and codelqdiscdequeue...

CVE-2025-37798

In the Linux kernel, the following vulnerability has been resolved: codel: remove sch-q.qlen check before qdisctreereducebacklog After making all -qlennotify callbacks idempotent, now it is safe to remove the check of qlen!=0 from both fqcodeldequeue and codelqdiscdequeue...

CVE-2025-37798

CVE-2025-37798 affects the Linux kernel networking code. The fix removes the qlen check in fq_codel_dequeue() and codel_qdisc_dequeue() after making sch->qlen_notify() callbacks idempotent. The description indicates the vulnerability related to backlog/queue length handling in qdisc code (code...

DEBIAN-CVE-2022-49921

In the Linux kernel, the following vulnerability has been resolved: net: sched: Fix use after free in redenqueue We can't use "skb" again after passing it to qdiscenqueue. This is basically identical to commit 2f09707d0c97 "schsfb: Also store skb len before calling child enqueue"...

PT-2025-22177

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A vulnerability in the Linux kernel has been resolved, related to the net sched component, specifically the drr class with netem as a child qdisc. The issue arises when the parent qdisc'...

PT-2025-21643

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: A Use After Free UAF vulnerability has been identified in the Linux kernel's HFSC network scheduler when it has a netem child qdisc. The issue arises because the HFSC assumes that...

PT-2025-18776

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A Use-After-Free vulnerability has been identified in the HFSC qdisc class handling of the Linux kernel. The issue arises from a time-of-check/time-of-use condition in hfsc change class...

SUSE CVE-2025-38637

In the Linux kernel, the following vulnerability has been resolved: netsched: skbprio: Remove overly strict queue assertions In the current implementation, skbprio enqueue/dequeue contains an assertion that fails under certain conditions when SKBPRIO is used as a child qdisc under TBF with specif...

The vulnerability of the qdisc_pkt_len_init() function in the net/core/dev.c module of the Linux kernel allows a hacker to cause a service failure.

The vulnerability of the qdiscpktleninit function in the net/core/dev.c module of the Linux kernel is related to the pointer manipulation. Exploiting this vulnerability could allow an attacker to cause a service failure...

CVE-2025-22061 net: airoha: Fix qid report in airoha_tc_get_htb_get_leaf_queue()

In the Linux kernel, the following vulnerability has been resolved: net: airoha: Fix qid report in airohatcgethtbgetleafqueue Fix the following kernel warning deleting HTB offloaded leafs and/or root HTB qdisc in airohaeth driver properly reporting qid in airohatcgethtbgetleafqueue routine. $tc...

CVE-2025-22061

CVE-2025-22061 concerns the Linux kernel’s airoha Ethernet driver (airoha_eth) and the function airoha_tc_get_htb_get_leaf_queue() . Connected advisories explicitly state the root cause as a fix to the qid reporting in that routine, addressing kernel warnings when deleting HTB offloaded qdiscs. T...