net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2025-39766
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2025-09-11 17:15:41 UTC
Updated2026-05-12 13:17:10 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit The following setup can trigger a WARNING in htb_activate due to the condition: !cl->leaf.q->q.qlen tc qdisc del dev lo root tc qdisc add dev lo root handle 1: htb default 1 tc class add dev lo parent 1: classid 1:1 \ htb rate 64bit tc qdisc add dev lo parent 1:1 handle f: \ cake memlimit 1b ping -I lo -f -c1 -s64 -W0.001 127.0.0.1 This is because the low memlimit leads to a low buffer_limit, which causes packet dropping. However, cake_enqueue still returns NET_XMIT_SUCCESS, causing htb_enqueue to call htb_activate with an empty child qdisc. We should return NET_XMIT_CN when packets are dropped from the same tin and flow. I do not believe return value of NET_XMIT_CN is necessary for packet drops in the case of ack filtering, as that is meant to optimize performance, not to signal congestion.

Risk And Classification

Primary CVSS: v3.1 7.8 HIGH from [email protected]

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Problem Types: NVD-CWE-noinfo

CVSS v3.1 Breakdown

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD Known Affected Configurations (CPE 2.3)

TypeVendorProductVersionUpdateEditionLanguage
Operating System Linux Linux Kernel All All All All

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected 046f6fd5daefac7f5abdafb436b30f63bc7c602b 7689ab22de36f8db19095f6bdf11f28cfde92f5c git Not specified
CNA Linux Linux affected 046f6fd5daefac7f5abdafb436b30f63bc7c602b de04ddd2980b48caa8d7e24a7db2742917a8b280 git Not specified
CNA Linux Linux affected 046f6fd5daefac7f5abdafb436b30f63bc7c602b 0dacfc5372e314d1219f03e64dde3ab495a5a25e git Not specified
CNA Linux Linux affected 046f6fd5daefac7f5abdafb436b30f63bc7c602b 710866fc0a64eafcb8bacd91bcb1329eb7e5035f git Not specified
CNA Linux Linux affected 046f6fd5daefac7f5abdafb436b30f63bc7c602b aa12ee1c1bd260943fd6ab556d8635811c332eeb git Not specified
CNA Linux Linux affected 046f6fd5daefac7f5abdafb436b30f63bc7c602b ff57186b2cc39766672c4c0332323933e5faaa88 git Not specified
CNA Linux Linux affected 046f6fd5daefac7f5abdafb436b30f63bc7c602b 62d591dde4defb1333d202410609c4ddeae060b3 git Not specified
CNA Linux Linux affected 046f6fd5daefac7f5abdafb436b30f63bc7c602b 15de71d06a400f7fdc15bf377a2552b0ec437cf5 git Not specified
CNA Linux Linux affected 4.19 Not specified
CNA Linux Linux unaffected 4.19 semver Not specified
CNA Linux Linux unaffected 5.4.297 5.4.* semver Not specified
CNA Linux Linux unaffected 5.10.241 5.10.* semver Not specified
CNA Linux Linux unaffected 5.15.190 5.15.* semver Not specified
CNA Linux Linux unaffected 6.1.149 6.1.* semver Not specified
CNA Linux Linux unaffected 6.6.103 6.6.* semver Not specified
CNA Linux Linux unaffected 6.12.44 6.12.* semver Not specified
CNA Linux Linux unaffected 6.16.4 6.16.* semver Not specified
CNA Linux Linux unaffected 6.17 * original_commit_for_fix Not specified
ADP Siemens SIMATIC CN 4100 affected V5.0 custom Not specified

References

ReferenceSourceLinkTags
lists.debian.org/debian-lts-announce/2025/10/msg00008.html af854a3a-2127-422b-91ae-364da2661108 lists.debian.org Mailing List, Third Party Advisory
git.kernel.org/stable/c/62d591dde4defb1333d202410609c4ddeae060b3 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
git.kernel.org/stable/c/7689ab22de36f8db19095f6bdf11f28cfde92f5c 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
git.kernel.org/stable/c/de04ddd2980b48caa8d7e24a7db2742917a8b280 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
cert-portal.siemens.com/productcert/html/ssa-032379.html 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e cert-portal.siemens.com
git.kernel.org/stable/c/ff57186b2cc39766672c4c0332323933e5faaa88 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
git.kernel.org/stable/c/aa12ee1c1bd260943fd6ab556d8635811c332eeb 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
git.kernel.org/stable/c/0dacfc5372e314d1219f03e64dde3ab495a5a25e 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
git.kernel.org/stable/c/15de71d06a400f7fdc15bf377a2552b0ec437cf5 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
git.kernel.org/stable/c/710866fc0a64eafcb8bacd91bcb1329eb7e5035f 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
lists.debian.org/debian-lts-announce/2025/10/msg00007.html af854a3a-2127-422b-91ae-364da2661108 lists.debian.org Mailing List, Third Party Advisory
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report