CVE-2025-39677

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net/sched: Fix backlog accounting in qdisc_dequeue_internal

This issue applies for the following qdiscs: hhf, fq, fq_codel, and

fq_pie, and occurs in their change handlers when adjusting to the new

limit. The problem is the following in the values passed to the

subsequent qdisc_tree_reduce_backlog call given a tbf parent:

When the tbf parent runs out of tokens, skbs of these qdiscs will

be placed in gso_skb. Their peek handlers are qdisc_peek_dequeued,

which accounts for both qlen and backlog. However, in the case of

qdisc_dequeue_internal, ONLY qlen is accounted for when pulling

from gso_skb. This means that these qdiscs are missing a

qdisc_qstats_backlog_dec when dropping packets to satisfy the

new limit in their change handlers.

One can observe this issue with the following (with tc patched to

support a limit of 0):

export TARGET=fq

tc qdisc del dev lo root

tc qdisc add dev l

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References