{"id":"CVE-2025-39677","title":"net/sched: Fix backlog accounting in qdisc_dequeue_internal","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: Fix backlog accounting in qdisc_dequeue_internal\n\nThis issue applies for the following qdiscs: hhf, fq, fq_codel, and\nfq_pie, and occurs in their change hand…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= 4b549a2ef4bef9965d97cbd992ba67930cd3e0fe < dcfed7251e23cd71d32c4ecc444ff97992087e46","Linux >= 4b549a2ef4bef9965d97cbd992ba67930cd3e0fe < 38cdf8d1f5f3ee133f6e48dd422df4057fa9bfcb","Linux >= 4b549a2ef4bef9965d97cbd992ba67930cd3e0fe < a225f44d84b8900d679c5f5a9ea46fe9c0cc7802","Linux >= 4b549a2ef4bef9965d97cbd992ba67930cd3e0fe < 52bf272636bda69587952b35ae97690b8dc89941","Linux 3.5"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-15T21:53:13.090718Z"},"published":"2025-09-05","updated":"2026-10-21","sourceUpdated":"2026-10-21T12:37:15.872Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-39677","references":[{"url":"https://git.kernel.org/stable/c/dcfed7251e23cd71d32c4ecc444ff97992087e46"},{"url":"https://git.kernel.org/stable/c/38cdf8d1f5f3ee133f6e48dd422df4057fa9bfcb"},{"url":"https://git.kernel.org/stable/c/a225f44d84b8900d679c5f5a9ea46fe9c0cc7802"},{"url":"https://git.kernel.org/stable/c/52bf272636bda69587952b35ae97690b8dc89941"}],"tags":["cve.org"],"epss":0.00205,"epssPercentile":0.10453,"ingestedAt":"2026-10-15T22:48:25.520Z","slug":"CVE-2025-39677","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: Fix backlog accounting in qdisc_dequeue_internal\n\nThis issue applies for the following qdiscs: hhf, fq, fq_codel, and\nfq_pie, and occurs in their change handlers when adjusting to the new\nlimit. The problem is the following in the values passed to the\nsubsequent qdisc_tree_reduce_backlog call given a tbf parent:\n\n   When the tbf parent runs out of tokens, skbs of these qdiscs will\n   be placed in gso_skb. Their peek handlers are qdisc_peek_dequeued,\n   which accounts for both qlen and backlog. However, in the case of\n   qdisc_dequeue_internal, ONLY qlen is accounted for when pulling\n   from gso_skb. This means that these qdiscs are missing a\n   qdisc_qstats_backlog_dec when dropping packets to satisfy the\n   new limit in their change handlers.\n\n   One can observe this issue with the following (with tc patched to\n   support a limit of 0):\n\n   export TARGET=fq\n   tc qdisc del dev lo root\n   tc qdisc add dev lo root handle 1: tbf rate 8bit burst 100b latency 1ms\n   tc qdisc replace dev lo handle 3: parent 1:1 $TARGET limit 1000\n   echo ''; echo 'add child'; tc -s -d qdisc show dev lo\n   ping -I lo -f -c2 -s32 -W0.001 127.0.0.1 2>&1 >/dev/null\n   echo ''; echo 'after ping'; tc -s -d qdisc show dev lo\n   tc qdisc change dev lo handle 3: parent 1:1 $TARGET limit 0\n   echo ''; echo 'after limit drop'; tc -s -d qdisc show dev lo\n   tc qdisc replace dev lo handle 2: parent 1:1 sfq\n   echo ''; echo 'post graft'; tc -s -d qdisc show dev lo\n\n   The second to last show command shows 0 packets but a positive\n   number (74) of backlog bytes. The problem becomes clearer in the\n   last show command, where qdisc_purge_queue triggers\n   qdisc_tree_reduce_backlog with the positive backlog and causes an\n   underflow in the tbf parent's backlog (4096 Mb instead of 0).\n\nTo fix this issue, the codepath for all clients of qdisc_dequeue_internal\nhas been simplified: codel, pie, hhf, fq, fq_pie, and fq_codel.\nqdisc_dequeue_internal handles the backlog adjustments for all cases that\ndo not directly use the dequeue handler.\n\nThe old fq_codel_change limit adjustment loop accumulated the arguments to\nthe subsequent qdisc_tree_reduce_backlog call through the cstats field.\nHowever, this is confusing and error prone as fq_codel_dequeue could also\npotentially mutate this field (which qdisc_dequeue_internal calls in the\nnon gso_skb case), so we have unified the code here with other qdiscs.\n\n## Affected\n\n- `Linux >= 4b549a2ef4bef9965d97cbd992ba67930cd3e0fe < dcfed7251e23cd71d32c4ecc444ff97992087e46`\n- `Linux >= 4b549a2ef4bef9965d97cbd992ba67930cd3e0fe < 38cdf8d1f5f3ee133f6e48dd422df4057fa9bfcb`\n- `Linux >= 4b549a2ef4bef9965d97cbd992ba67930cd3e0fe < a225f44d84b8900d679c5f5a9ea46fe9c0cc7802`\n- `Linux >= 4b549a2ef4bef9965d97cbd992ba67930cd3e0fe < 52bf272636bda69587952b35ae97690b8dc89941`\n- `Linux 3.5`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}