CVE-2025-38637

Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
18/04/2025
Last modified:
06/11/2025

Description

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net_sched: skbprio: Remove overly strict queue assertions<br /> <br /> In the current implementation, skbprio enqueue/dequeue contains an assertion<br /> that fails under certain conditions when SKBPRIO is used as a child qdisc under<br /> TBF with specific parameters. The failure occurs because TBF sometimes peeks at<br /> packets in the child qdisc without actually dequeuing them when tokens are<br /> unavailable.<br /> <br /> This peek operation creates a discrepancy between the parent and child qdisc<br /> queue length counters. When TBF later receives a high-priority packet,<br /> SKBPRIO&amp;#39;s queue length may show a different value than what&amp;#39;s reflected in its<br /> internal priority queue tracking, triggering the assertion.<br /> <br /> The fix removes this overly strict assertions in SKBPRIO, they are not<br /> necessary at all.

Vulnerable products and versions

CPE From Up to
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 4.19 (including) 5.4.292 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 5.5 (including) 5.10.236 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 5.11 (including) 5.15.180 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 5.16 (including) 6.1.134 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 6.2 (including) 6.6.87 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 6.7 (including) 6.12.23 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 6.13 (including) 6.13.11 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 6.14 (including) 6.14.2 (excluding)
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*