CVE-2025-38637: net_sched: skbprio: Remove overly strict queue assertions
In the Linux kernel, the following vulnerability has been resolved:
netsched: skbprio: Remove overly strict queue assertions
In the current implementation, skbprio enqueue/dequeue contains an assertion that fails under certain conditions when SKBPRIO is used as a child qdisc under TBF with specific parameters. The failure occurs because TBF sometimes peeks at packets in the child qdisc without actually dequeuing them when tokens are unavailable.
This peek operation creates a discrepancy between the parent and child qdisc queue length counters. When TBF later receives a high-priority packet, SKBPRIO's queue length may show a different value than what's reflected in its internal priority queue tracking, triggering the assertion.
The fix removes this overly strict assertions in SKBPRIO, they are not necessary at all.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38637?
CVE-2025-38637 has been assigned a severity rating of medium due to its impact on queue management in the Linux kernel.
How do I fix CVE-2025-38637?
To resolve CVE-2025-38637, upgrade to the patched version of the Linux kernel where the issue has been addressed.
What software is affected by CVE-2025-38637?
CVE-2025-38637 affects the Linux kernel, specifically the network scheduling component dealing with skbprio.
Is CVE-2025-38637 exploitable remotely?
CVE-2025-38637 does not appear to be directly exploitable remotely as it involves local processes interacting with the kernel.
What are the implications of not addressing CVE-2025-38637?
Failure to address CVE-2025-38637 could lead to instability in network queue management, potentially affecting system performance.