PT-2025-36272 · Hhf+7 · Hhf+7

Published

2025-01-01

·

Updated

2026-04-20

·

CVE-2025-39677

CVSS v2.0

6.0

Medium

VectorAV:L/AC:H/Au:S/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)
Description A flaw exists in the Linux kernel's networking scheduler related to backlog accounting within the qdisc dequeue internal function. This issue affects the hhf, fq, fq codel, and fq pie qdiscs when adjusting to new limits, leading to inaccurate backlog calculations. Specifically, when a tbf parent runs out of tokens, packets are placed in gso skb, and only the queue length (qlen) is accounted for, while the backlog is not updated correctly. This discrepancy results in an underflow in the tbf parent's backlog during queue purging. The fix simplifies the codepath for clients of qdisc dequeue internal, unifying the code across affected qdiscs.
Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Integer Underflow

Weakness Enumeration

Related Identifiers

AZL-66986
AZL-70789
BDU:2026-02857
CVE-2025-39677
ECHO-21B4-FB15-2611
OPENSUSE-SU-2025:20081-1
SUSE-SU-2025:03600-1
SUSE-SU-2025:03601-1
SUSE-SU-2025:03614-1
SUSE-SU-2025:03633-1
SUSE-SU-2025:03634-1
SUSE-SU-2025:20851-1
SUSE-SU-2025:20861-1
SUSE-SU-2025:20870-1
SUSE-SU-2025:20898-1
SUSE-SU-2025:21074-1
SUSE-SU-2025:21139-1
SUSE-SU-2025:21179-1
SUSE-SU-2025:3725-1
SUSE-SU-2025:3751-1

Affected Products

Debian
Linux Kernel
Suse
Fq
Fq Codel
Fq Pie
Hhf
Tbf