net/sched: netem: account for backlog updates from child qdisc

...

kernel: net: avoid potential underflow in qdisc_pkt_len_init() with UFO

A flaw was found in the Linux kernel's network handling. A local user could craft a specific Generic Segmentation Offload GSO packet with UDP Fragmentation Offload UFO characteristics. This crafted packet could lead to an underflow in the qdiscpktleninit function, causing a kernel NULL pointer...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: net/sched: netem: account for backlog updates from child qdisc Generally, the qlen of any classful qdisc should reflect the number of packets held by the qdisc itself and all its children. In the case of netem, qlen only accounts...

DEBIAN-CVE-2024-56770

In the Linux kernel, the following vulnerability has been resolved: net/sched: netem: account for backlog updates from child qdisc In general, 'qlen' of any classful qdisc should keep track of the number of packets that the qdisc itself and all of its children holds. In case of netem, 'qlen' only...

PT-2025-36272

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the Linux kernel's networking scheduler related to backlog accounting within the qdisc dequeue internal function. This issue affects the hhf, fq, fq codel, and fq pie...

DEBIAN-CVE-2024-53164

In the Linux kernel, the following vulnerability has been resolved: net: sched: fix ordering of qlen adjustment Changes to sch-q.qlen around qdisctreereducebacklog need to happen before a call to said function because otherwise it may fail to notify parent qdiscs when the child is about to become...

net/sched: accept TCA_STAB only for root qdisc

...

AZL-51482 CVE-2024-50039 affecting package kernel for versions less than 6.6.57.1-1

In the Linux kernel, the following vulnerability has been resolved: net/sched: accept TCASTAB only for root qdisc Most qdiscs maintain their backlog using qdiscpktlenskb on the assumption it is invariant between the enqueue and dequeue handlers. Unfortunately syzbot can crash a host rather easily...

DEBIAN-CVE-2024-50039

In the Linux kernel, the following vulnerability has been resolved: net/sched: accept TCASTAB only for root qdisc Most qdiscs maintain their backlog using qdiscpktlenskb on the assumption it is invariant between the enqueue and dequeue handlers. Unfortunately syzbot can crash a host rather easily...

kernel: net: sched: sch_multiq: fix possible OOB write in multiq_tune()

An out-of-bounds write flaw was found in the Linux kernel's multiq qdisc functionality. This vulnerability allows a local user to crash or potentially escalate their privileges on the system...

SUSE CVE-2024-45016

In the Linux kernel, the following vulnerability has been resolved: netem: fix return value if duplicate enqueue fails There is a bug in netemenqueue introduced by commit 5845f706388a "net: netem: fix skb length BUGON in skbtosgvec" that can lead to a use-after-free. This commit made netemenqueue...

SUSE CVE-2021-47243

In the Linux kernel, the following vulnerability has been resolved: schcake: Fix out of bounds when parsing TCP options and header The TCP option parser in cake qdisc cakegettcpopt and caketcphmaydrop could read one byte out of bounds. When the length is 1, the execution flow gets into the loop,...

UBUNTU-CVE-2024-35892

In the Linux kernel, the following vulnerability has been resolved: net/sched: fix lockdep splat in qdisctreereducebacklog qdisctreereducebacklog is called with the qdisc lock held, not RTNL. We must use qdisclookuprcu instead of qdisclookup syzbot reported: WARNING: suspicious RCU usage...

kernel: use-after-free in sch_qfq network scheduler

A use-after-free flaw was found in qfqdequeue and aggdequeue in net/sched/schqfq.c in the Traffic Control QoS subsystem in the Linux kernel. This issue may allow a local user to crash the system or escalate their privileges on the system...

kernel: net/sched: sch_fq: fix integer overflow of "credit"

An integer overflow flaw was found in the Linux kernel network fair-queueing scheduler in the way the initial per-flow credit is set. If a configuration provides an excessively large initial quantum, the credit value can overflow to a negative number, leading to excessive scheduling and soft...

PT-2024-8456

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The vulnerability is caused by an API design decision in the Linux kernel's net/sched component, specifically in the taprio qdisc. When attempting full offload, the taprio qdisc starts...