CVE-2025-37992

net_sched: Flush gso_skb list too during ->change()

published May 26, 2025

CVSS
—
EPSS
0%
Percentile
11.5
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

net_sched: Flush gso_skb list too during ->change()

Previously, when reducing a qdisc's limit via the ->change() operation, only

the main skb queue was trimmed, potentially leaving packets in the gso_skb

list. This could result in NULL pointer dereference when we only check

sch->limit against sch->q.qlen.

This patch introduces a new helper, qdisc_dequeue_internal(), which ensures

both the gso_skb list and the main queue are properly flushed when trimming

excess packets. All relevant qdiscs (codel, fq, fq_codel, fq_pie, hhf, pie)

are updated to use this helper in their ->change() routines.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00217 · 11.5th percentile
Published
2025-05-26T14:54Z
EPSS history
Timeline
  • 26 MAY 14:54Z
    net_sched: Flush gso_skb list too during ->change()
    cvelistv5