CVE-2025-38115

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net_sched: sch_sfq: fix a potential crash on gso_skb handling<br /> <br /> SFQ has an assumption of always being able to queue at least one packet.<br /> <br /> However, after the blamed commit, sch-&gt;q.len can be inflated by packets<br /> in sch-&gt;gso_skb, and an enqueue() on an empty SFQ qdisc can be followed<br /> by an immediate drop.<br /> <br /> Fix sfq_drop() to properly clear q-&gt;tail in this situation.<br /> <br /> <br /> ip netns add lb<br /> ip link add dev to-lb type veth peer name in-lb netns lb<br /> ethtool -K to-lb tso off # force qdisc to requeue gso_skb<br /> ip netns exec lb ethtool -K in-lb gro on # enable NAPI<br /> ip link set dev to-lb up<br /> ip -netns lb link set dev in-lb up<br /> ip addr add dev to-lb 192.168.20.1/24<br /> ip -netns lb addr add dev in-lb 192.168.20.2/24<br /> tc qdisc replace dev to-lb root sfq limit 100<br /> <br /> ip netns exec lb netserver<br /> <br /> netperf -H 192.168.20.2 -l 100 &amp;<br /> netperf -H 192.168.20.2 -l 100 &amp;<br /> netperf -H 192.168.20.2 -l 100 &amp;<br /> netperf -H 192.168.20.2 -l 100 &amp;