CVE-2025-68325 | THREATINT

Description

In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop In cake_drop(), qdisc_tree_reduce_backlog() is used to update the qlen and backlog of the qdisc hierarchy. Its caller, cake_enqueue(), assumes that the parent qdisc will enqueue the current packet. However, this assumption breaks when cake_enqueue() returns NET_XMIT_CN: the parent qdisc stops enqueuing current packet, leaving the tree qlen/backlog accounting inconsistent. This mismatch can lead to a NULL dereference (e.g., when the parent Qdisc is qfq_qdisc). This patch computes the qlen/backlog delta in a more robust way by observing the difference before and after the series of cake_drop() calls, and then compensates the qdisc tree accounting if cake_enqueue() returns NET_XMIT_CN. To ensure correct compensation when ACK thinning is enabled, a new variable is introduced to keep qlen unchanged.

PUBLISHED Reserved 2025-12-16 | Published 2025-12-18 | Updated 2025-12-18 | Assigner Linux

Product status

Default status

unaffected

ff57186b2cc39766672c4c0332323933e5faaa88 (git) before 0b6216f9b3d1c33c76f74511026e5de5385ee520

affected

15de71d06a400f7fdc15bf377a2552b0ec437cf5 (git) before 529c284cc2815c8350860e9a31722050fe7117cb

affected

15de71d06a400f7fdc15bf377a2552b0ec437cf5 (git) before 3ed6c458530a547ed0c9ea0b02b19bab620be88b

affected

15de71d06a400f7fdc15bf377a2552b0ec437cf5 (git) before 9fefc78f7f02d71810776fdeb119a05a946a27cc

affected

7689ab22de36f8db19095f6bdf11f28cfde92f5c (git)

affected

de04ddd2980b48caa8d7e24a7db2742917a8b280 (git)

affected

0dacfc5372e314d1219f03e64dde3ab495a5a25e (git)

affected

710866fc0a64eafcb8bacd91bcb1329eb7e5035f (git)

affected

aa12ee1c1bd260943fd6ab556d8635811c332eeb (git)

affected

62d591dde4defb1333d202410609c4ddeae060b3 (git)

affected

Default status

affected

6.17

affected

Any version before 6.17

unaffected

6.12.63 (semver)

unaffected

6.17.13 (semver)

unaffected

6.18.2 (semver)

unaffected

6.19-rc1 (original_commit_for_fix)

unaffected

References

git.kernel.org/...c/0b6216f9b3d1c33c76f74511026e5de5385ee520

git.kernel.org/...c/529c284cc2815c8350860e9a31722050fe7117cb

git.kernel.org/...c/3ed6c458530a547ed0c9ea0b02b19bab620be88b

git.kernel.org/...c/9fefc78f7f02d71810776fdeb119a05a946a27cc

cve.org (CVE-2025-68325)

nvd.nist.gov (CVE-2025-68325)

Download JSON