CVE-2025-38637
Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
18/04/2025
Last modified:
06/11/2025
Description
In the Linux kernel, the following vulnerability has been resolved:<br />
<br />
net_sched: skbprio: Remove overly strict queue assertions<br />
<br />
In the current implementation, skbprio enqueue/dequeue contains an assertion<br />
that fails under certain conditions when SKBPRIO is used as a child qdisc under<br />
TBF with specific parameters. The failure occurs because TBF sometimes peeks at<br />
packets in the child qdisc without actually dequeuing them when tokens are<br />
unavailable.<br />
<br />
This peek operation creates a discrepancy between the parent and child qdisc<br />
queue length counters. When TBF later receives a high-priority packet,<br />
SKBPRIO&#39;s queue length may show a different value than what&#39;s reflected in its<br />
internal priority queue tracking, triggering the assertion.<br />
<br />
The fix removes this overly strict assertions in SKBPRIO, they are not<br />
necessary at all.
Impact
Base Score 3.x
5.50
Severity 3.x
MEDIUM
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 4.19 (including) | 5.4.292 (excluding) |
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 5.5 (including) | 5.10.236 (excluding) |
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 5.11 (including) | 5.15.180 (excluding) |
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 5.16 (including) | 6.1.134 (excluding) |
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 6.2 (including) | 6.6.87 (excluding) |
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 6.7 (including) | 6.12.23 (excluding) |
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 6.13 (including) | 6.13.11 (excluding) |
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 6.14 (including) | 6.14.2 (excluding) |
| cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* |
To consult the complete list of CPE names with products and versions, see this page
References to Advisories, Solutions, and Tools
- https://git.kernel.org/stable/c/034b293bf17c124fec0f0e663f81203b00aa7a50
- https://git.kernel.org/stable/c/1284733bab736e598341f1d3f3b94e2a322864a8
- https://git.kernel.org/stable/c/1dcc144c322a8d526b791135604c0663f1af9d85
- https://git.kernel.org/stable/c/2286770b07cb5268c03d11274b8efd43dff0d380
- https://git.kernel.org/stable/c/2f35b7673a3aa3d09b3eb05811669622ebaa98ca
- https://git.kernel.org/stable/c/32ee79682315e6d3c99947b3f38b078a09a66919
- https://git.kernel.org/stable/c/7abc8318ce0712182bf0783dcfdd9a6a8331160e
- https://git.kernel.org/stable/c/864ca690ff135078d374bd565b9872f161c614bc
- https://git.kernel.org/stable/c/ce8fe975fd99b49c29c42e50f2441ba53112b2e8
- https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html
- https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html



