CVE-2025-68815

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

net/sched: ets: Remove drr class from the active list if it changes to strict

Whenever a user issues an ets qdisc change command, transforming a

drr class into a strict one, the ets code isn't checking whether that

class was in the active list and removing it. This means that, if a

user changes a strict class (which was in the active list) back to a drr

one, that class will be added twice to the active list [1].

Doing so with the following commands:

tc qdisc add dev lo root handle 1: ets bands 2 strict 1

tc qdisc add dev lo parent 1:2 handle 20: \

tbf rate 8bit burst 100b latency 1s

tc filter add dev lo parent 1: basic classid 1:2

ping -c1 -W0.01 -s 56 127.0.0.1

tc qdisc change dev lo root handle 1: ets bands 2 strict 2

tc qdisc change dev lo root handle 1: ets bands 2 strict 1

ping -c1 -W0.01 -s 56 127.0.0.1

Will trigger the following splat with list debug turned on:

[ 59.279014][ T365] ------------[ cut

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References