Vulnerability Database

319,194

Total vulnerabilities in the database

CVE-2025-37992

In the Linux kernel, the following vulnerability has been resolved:

net_sched: Flush gso_skb list too during ->change()

Previously, when reducing a qdisc's limit via the ->change() operation, only the main skb queue was trimmed, potentially leaving packets in the gso_skb list. This could result in NULL pointer dereference when we only check sch->limit against sch->q.qlen.

This patch introduces a new helper, qdisc_dequeue_internal(), which ensures both the gso_skb list and the main queue are properly flushed when trimming excess packets. All relevant qdiscs (codel, fq, fq_codel, fq_pie, hhf, pie) are updated to use this helper in their ->change() routines.

  • Published: May 26, 2025
  • Updated: Dec 17, 2025
  • CVE: CVE-2025-37992
  • Severity: Medium
  • Exploit:

CVSS v3:

  • Severity: Medium
  • Score: 5.5
  • AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWEs:

Software From Fixed in
linux / linux_kernel 3.5 5.10.238
linux / linux_kernel 5.11 5.15.184
linux / linux_kernel 5.16 6.1.140
linux / linux_kernel 6.2 6.6.92
linux / linux_kernel 6.7 6.12.30
linux / linux_kernel 6.13 6.14.8
linux / linux_kernel 6.15-rc1 6.15-rc1.x
linux / linux_kernel 6.15-rc2 6.15-rc2.x
linux / linux_kernel 6.15-rc3 6.15-rc3.x
linux / linux_kernel 6.15-rc4 6.15-rc4.x
linux / linux_kernel 6.15-rc5 6.15-rc5.x
linux / linux_kernel 6.15-rc6 6.15-rc6.x
debian / debian_linux 11.0 11.0.x