---
id: CVE-2025-39677
title: 'net/sched: Fix backlog accounting in qdisc_dequeue_internal'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  net/sched: Fix backlog accounting in qdisc_dequeue_internal

  This issue applies for the following qdiscs: hhf, fq, fq_codel, and
  fq_pie, and occurs in their change hand…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 4b549a2ef4bef9965d97cbd992ba67930cd3e0fe <
    dcfed7251e23cd71d32c4ecc444ff97992087e46
  - >-
    Linux >= 4b549a2ef4bef9965d97cbd992ba67930cd3e0fe <
    38cdf8d1f5f3ee133f6e48dd422df4057fa9bfcb
  - >-
    Linux >= 4b549a2ef4bef9965d97cbd992ba67930cd3e0fe <
    a225f44d84b8900d679c5f5a9ea46fe9c0cc7802
  - >-
    Linux >= 4b549a2ef4bef9965d97cbd992ba67930cd3e0fe <
    52bf272636bda69587952b35ae97690b8dc89941
  - Linux 3.5
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-15T21:53:13.090718Z'
published: '2025-09-05'
updated: '2026-10-21'
sourceUpdated: '2026-10-21T12:37:15.872Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-39677'
references:
  - url: 'https://git.kernel.org/stable/c/dcfed7251e23cd71d32c4ecc444ff97992087e46'
  - url: 'https://git.kernel.org/stable/c/38cdf8d1f5f3ee133f6e48dd422df4057fa9bfcb'
  - url: 'https://git.kernel.org/stable/c/a225f44d84b8900d679c5f5a9ea46fe9c0cc7802'
  - url: 'https://git.kernel.org/stable/c/52bf272636bda69587952b35ae97690b8dc89941'
tags:
  - cve.org
epss: 0.00205
epssPercentile: 0.10453
ingestedAt: '2026-10-15T22:48:25.520Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

net/sched: Fix backlog accounting in qdisc_dequeue_internal

This issue applies for the following qdiscs: hhf, fq, fq_codel, and
fq_pie, and occurs in their change handlers when adjusting to the new
limit. The problem is the following in the values passed to the
subsequent qdisc_tree_reduce_backlog call given a tbf parent:

   When the tbf parent runs out of tokens, skbs of these qdiscs will
   be placed in gso_skb. Their peek handlers are qdisc_peek_dequeued,
   which accounts for both qlen and backlog. However, in the case of
   qdisc_dequeue_internal, ONLY qlen is accounted for when pulling
   from gso_skb. This means that these qdiscs are missing a
   qdisc_qstats_backlog_dec when dropping packets to satisfy the
   new limit in their change handlers.

   One can observe this issue with the following (with tc patched to
   support a limit of 0):

   export TARGET=fq
   tc qdisc del dev lo root
   tc qdisc add dev lo root handle 1: tbf rate 8bit burst 100b latency 1ms
   tc qdisc replace dev lo handle 3: parent 1:1 $TARGET limit 1000
   echo ''; echo 'add child'; tc -s -d qdisc show dev lo
   ping -I lo -f -c2 -s32 -W0.001 127.0.0.1 2>&1 >/dev/null
   echo ''; echo 'after ping'; tc -s -d qdisc show dev lo
   tc qdisc change dev lo handle 3: parent 1:1 $TARGET limit 0
   echo ''; echo 'after limit drop'; tc -s -d qdisc show dev lo
   tc qdisc replace dev lo handle 2: parent 1:1 sfq
   echo ''; echo 'post graft'; tc -s -d qdisc show dev lo

   The second to last show command shows 0 packets but a positive
   number (74) of backlog bytes. The problem becomes clearer in the
   last show command, where qdisc_purge_queue triggers
   qdisc_tree_reduce_backlog with the positive backlog and causes an
   underflow in the tbf parent's backlog (4096 Mb instead of 0).

To fix this issue, the codepath for all clients of qdisc_dequeue_internal
has been simplified: codel, pie, hhf, fq, fq_pie, and fq_codel.
qdisc_dequeue_internal handles the backlog adjustments for all cases that
do not directly use the dequeue handler.

The old fq_codel_change limit adjustment loop accumulated the arguments to
the subsequent qdisc_tree_reduce_backlog call through the cstats field.
However, this is confusing and error prone as fq_codel_dequeue could also
potentially mutate this field (which qdisc_dequeue_internal calls in the
non gso_skb case), so we have unified the code here with other qdiscs.

## Affected

- `Linux >= 4b549a2ef4bef9965d97cbd992ba67930cd3e0fe < dcfed7251e23cd71d32c4ecc444ff97992087e46`
- `Linux >= 4b549a2ef4bef9965d97cbd992ba67930cd3e0fe < 38cdf8d1f5f3ee133f6e48dd422df4057fa9bfcb`
- `Linux >= 4b549a2ef4bef9965d97cbd992ba67930cd3e0fe < a225f44d84b8900d679c5f5a9ea46fe9c0cc7802`
- `Linux >= 4b549a2ef4bef9965d97cbd992ba67930cd3e0fe < 52bf272636bda69587952b35ae97690b8dc89941`
- `Linux 3.5`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.