CVE-2025-37992: net_sched: Flush gso_skb list too during ->change()
In the Linux kernel, the following vulnerability has been resolved:
netsched: Flush gsoskb list too during ->change()
Previously, when reducing a qdisc's limit via the ->change() operation, only the main skb queue was trimmed, potentially leaving packets in the gsoskb list. This could result in NULL pointer dereference when we only check sch->limit against sch->q.qlen.
This patch introduces a new helper, qdiscdequeueinternal(), which ensures both the gsoskb list and the main queue are properly flushed when trimming excess packets. All relevant qdiscs (codel, fq, fqcodel, fqpie, hhf, pie) are updated to use this helper in their ->change() routines.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-37992?
CVE-2025-37992 is categorized as a medium severity vulnerability in the Linux kernel.
How do I fix CVE-2025-37992?
To fix CVE-2025-37992, update the Linux kernel to the latest version that includes the patch for this vulnerability.
What impact does CVE-2025-37992 have on system performance?
CVE-2025-37992 may lead to potential packet loss and performance degradation during qdisc limit changes.
Is CVE-2025-37992 a remote exploitation vulnerability?
CVE-2025-37992 does not appear to be directly exploitable remotely; it requires local access to the system.
Which versions of the Linux kernel are affected by CVE-2025-37992?
CVE-2025-37992 affects certain versions of the Linux kernel prior to the patch release addressing this issue.