CVE-2025-39766

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit

The following setup can trigger a WARNING in htb_activate due to

the condition: !cl->leaf.q->q.qlen

tc qdisc del dev lo root

tc qdisc add dev lo root handle 1: htb default 1

tc class add dev lo parent 1: classid 1:1 \

htb rate 64bit

tc qdisc add dev lo parent 1:1 handle f: \

cake memlimit 1b

ping -I lo -f -c1 -s64 -W0.001 127.0.0.1

This is because the low memlimit leads to a low buffer_limit, which

causes packet dropping. However, cake_enqueue still returns

NET_XMIT_SUCCESS, causing htb_enqueue to call htb_activate with an

empty child qdisc. We should return NET_XMIT_CN when packets are

dropped from the same tin and flow.

I do not believe return value of NET_XMIT_CN is necessary for packet

drops in the case of ack filtering, as that is meant to optimize

performance, not to signal congestion.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References