In the Linux kernel, the following vulnerability has been resolved:
sch_htb: make htb_deactivate() idempotent
Alan reported a NULL pointer dereference in htb_next_rb_node() after we made htb_qlen_notify() idempotent.
It turns out in the following case it introduced some regression:
htb_dequeue_tree(): |-> fq_codel_dequeue() |-> qdisc_tree_reduce_backlog() |-> htb_qlen_notify() |-> htb_deactivate() |-> htb_next_rb_node() |-> htb_deactivate()
For htb_next_rb_node(), after calling the 1st htb_deactivate(), the clprio[prio]->ptr could be already set to NULL, which means htb_next_rb_node() is vulnerable here.
For htb_deactivate(), although we checked qlen before calling it, in case of qlen==0 after qdisc_tree_reduce_backlog(), we may call it again which triggers the warning inside.
To fix the issues here, we need to:
1) Make htb_deactivate() idempotent, that is, simply return if we already call it before. 2) Make htb_next_rb_node() safe against ptr==NULL.
Many thanks to Alan for testing and for the reproducer.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux-6.1Upgrade linux | May 28, 2025 | May 20, 2025 |
| Dell Powerstore Dsa2025429 | — | Upgrade Dell PowerStoreOS to the latest version | Dec 3, 2025 | Dec 2, 2025 |
| Dell Powerstore Dsa2026039 | — | Upgrade Dell PowerStoreOS to the latest version | Jan 13, 2026 | Jan 6, 2026 |
| Oracle_linux | — | Upgrade kernel-uek | Aug 12, 2025 | May 20, 2025 |
| Redhat_linux | — | — | Jul 9, 2025 | May 20, 2025 |
| Suse | — | Upgrade dlm-kmp-defaultUpgrade kernel-azure-vdsoUpgrade kernel-rt-develUpgrade kernel-devel-rtUpgrade kselftests-kmp-defaultUpgrade dtb-armUpgrade dtb-renesasUpgrade kernel-defaultUpgrade dtb-rockchipUpgrade ocfs2-kmp-defaultUpgrade dtb-socionextUpgrade kselftests-kmp-rtUpgrade kernel-obs-buildUpgrade kernel-rt-extraUpgrade kselftests-kmp-azureUpgrade kernel-azureUpgrade cluster-md-kmp-64kbUpgrade kernel-default-manUpgrade dtb-nvidiaUpgrade kernel-preempt-develUpgrade kernel-rt-livepatch-develUpgrade kernel-rt_debug-vdsoUpgrade dtb-allwinnerUpgrade kernel-default-base-rebuildUpgrade dtb-caviumUpgrade kselftests-kmp-64kbUpgrade dtb-amlogicUpgrade kernel-obs-qaUpgrade kernel-macrosUpgrade dtb-lgUpgrade kernel-debug-develUpgrade kernel-debugUpgrade kernel-azure-develUpgrade dtb-appleUpgrade kernel-zfcpdumpUpgrade kernel-symsUpgrade kernel-rtUpgrade kernel-syms-azureUpgrade dtb-alteraUpgrade cluster-md-kmp-azureUpgrade cluster-md-kmp-defaultUpgrade kernel-source-azureUpgrade kernel-sourceUpgrade kernel-preemptUpgrade gfs2-kmp-rtUpgrade dlm-kmp-64kbUpgrade dtb-amazonUpgrade ocfs2-kmp-rtUpgrade dtb-marvellUpgrade reiserfs-kmp-64kbUpgrade kernel-rt_debug-develUpgrade kernel-default-vdsoUpgrade kernel-default-optionalUpgrade dtb-broadcomUpgrade kernel-default-extraUpgrade cluster-md-kmp-rtUpgrade kernel-devel-azureUpgrade kernel-azure-optionalUpgrade gfs2-kmp-azureUpgrade dtb-apmUpgrade ocfs2-kmp-64kbUpgrade dtb-freescaleUpgrade kernel-64kb-develUpgrade kernel-64kb-optionalUpgrade dtb-exynosUpgrade kernel-kvmsmallUpgrade kernel-default-develUpgrade dtb-qcomUpgrade kernel-default-livepatchUpgrade kernel-source-rtUpgrade kernel-kvmsmall-develUpgrade kernel-64kbUpgrade kernel-kvmsmall-vdsoUpgrade kernel-docs-htmlUpgrade gfs2-kmp-64kbUpgrade dtb-hisiliconUpgrade kernel-azure-extraUpgrade reiserfs-kmp-azureUpgrade dlm-kmp-azureUpgrade kernel-syms-rtUpgrade gfs2-kmp-defaultUpgrade ocfs2-kmp-azureUpgrade dtb-xilinxUpgrade dtb-sprdUpgrade kernel-64kb-extraUpgrade kernel-debug-vdsoUpgrade reiserfs-kmp-rtUpgrade dlm-kmp-rt | Dec 5, 2025 | Jun 16, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jul 2, 2025 | May 20, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub