In the Linux kernel, the following vulnerability has been resolved:
net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree
htb_lookup_leaf has a BUG_ON that can trigger with the following:
tc qdisc del dev lo root tc qdisc add dev lo root handle 1: htb default 1 tc class add dev lo parent 1: classid 1:1 htb rate 64bit tc qdisc add dev lo parent 1:1 handle 2: netem tc qdisc add dev lo parent 2:1 handle 3: blackhole ping -I lo -c1 -W0.001 127.0.0.1
The root cause is the following:
1. htb_dequeue calls htb_dequeue_tree which calls the dequeue handler on the selected leaf qdisc 2. netem_dequeue calls enqueue on the child qdisc 3. blackhole_enqueue drops the packet and returns a value that is not just NET_XMIT_SUCCESS 4. Because of this, netem_dequeue calls qdisc_tree_reduce_backlog, and since qlen is now 0, it calls htb_qlen_notify -> htb_deactivate -> htb_deactiviate_prios -> htb_remove_class_from_row -> htb_safe_rb_erase 5. As this is the only class in the selected hprio rbtree, __rb_change_child in __rb_erase_augmented sets the rb_root pointer to NULL 6. Because blackhole_dequeue returns NULL, netem_dequeue returns NULL, which causes htb_dequeue_tree to call htb_lookup_leaf with the same hprio rbtree, and fail the BUG_ON
The function graph for this scenario is shown here: 0) | htb_enqueue() { 0) + 13.635 us | netem_enqueue(); 0) 4.719 us | htb_activate_prios(); 0) # 2249.199 us | } 0) | htb_dequeue() { 0) 2.355 us | htb_lookup_leaf(); 0) | netem_dequeue() { 0) + 11.061 us | blackhole_enqueue(); 0) | qdisc_tree_reduce_backlog() { 0) | qdisc_lookup_rcu() { 0) 1.873 us | qdisc_match_from_root(); 0) 6.292 us | } 0) 1.894 us | htb_search(); 0) | htb_qlen_notify() { 0) 2.655 us | htb_deactivate_prios(); 0) 6.933 us | } 0) + 25.227 us | } 0) 1.983 us | blackhole_dequeue(); 0) + 86.553 us | } 0) # 2932.761 us | qdisc_warn_nonwc(); 0) | htb_lookup_leaf() { 0) | BUG_ON(); ------------------------------------------
The full original bug report can be seen here [1].
We can fix this just by returning NULL instead of the BUG_ON, as htb_dequeue_tree returns NULL when htb_lookup_leaf returns NULL.
[1] https://lore.kernel.org/netdev/pF5XOOIim0IuEfhI-SOxTgRvNoDwuux7UHKnE_Y5-zVd4wmGvNk2ceHjKb8ORnzw0cGwfmVu42g9dL7XyJLf1NEzaztboTWcm0Ogxuojoeo=@willsroot.io/
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernel-debuginfo-common-aarch64Upgrade kernel-develUpgrade perfUpgrade kernel-toolsUpgrade python-perfUpgrade bpftoolUpgrade kernel-tools-develUpgrade bpftool-debuginfoUpgrade kernel-livepatch-5.10.242-239.961Upgrade python-perf-debuginfoUpgrade kernel-livepatch-5.15.191-132.213Upgrade perf-debuginfoUpgrade kernel-tools-debuginfoUpgrade kernel-headersUpgrade kernel-debuginfoUpgrade kernelUpgrade kernel-debuginfo-common-x86_64 | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade kernel6.12-debuginfoUpgrade perf6.12Upgrade python3-perf6.12-debuginfoUpgrade kernel6.12-tools-debuginfoUpgrade kernel6.12-tools-develUpgrade kernel6.12-headersUpgrade kernel-modules-extraUpgrade kernel6.12-develUpgrade kernel-libbpf-staticUpgrade kernel-livepatch-6.1.147-172.266Upgrade kernelUpgrade kernel-libbpf-develUpgrade kernel6.12-toolsUpgrade python3-perf-debuginfoUpgrade kernel-tools-debuginfoUpgrade bpftoolUpgrade kernel-debuginfo-common-x86_64Upgrade bpftool-debuginfoUpgrade perf-debuginfoUpgrade kernel-tools-develUpgrade kernel-modules-extra-commonUpgrade kernel-libbpfUpgrade python3-perfUpgrade kernel6.12-modules-extra-commonUpgrade kernel6.12-modules-extraUpgrade kernel-livepatch-6.12.40-63.114Upgrade bpftool6.12-debuginfoUpgrade bpftool6.12Upgrade kernel6.12-libbpf-debuginfoUpgrade kernel6.12-debuginfo-common-aarch64Upgrade kernel6.12Upgrade kernel-headersUpgrade kernel-libbpf-debuginfoUpgrade perf6.12-debuginfoUpgrade perfUpgrade kernel6.12-libbpf-staticUpgrade kernel-develUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-debuginfoUpgrade kernel6.12-debuginfo-common-x86_64Upgrade kernel6.12-libbpf-develUpgrade kernel6.12-libbpfUpgrade kernel-toolsUpgrade python3-perf6.12 | Oct 16, 2025 | Jul 28, 2025 |
| Debian | — | Upgrade linuxUpgrade linux-6.1 | Jul 31, 2025 | Jul 31, 2025 |
| Huawei Euleros 2_0_sp11 | — | Upgrade kernel-toolsUpgrade bpftoolUpgrade kernelUpgrade kernel-tools-libsUpgrade python3-perfUpgrade kernel-abi-stablelists | Mar 17, 2026 | Mar 17, 2026 |
| Huawei Euleros 2_0_sp12 | — | Upgrade kernel-toolsUpgrade python3-perfUpgrade kernel-abi-stablelistsUpgrade kernel-tools-libsUpgrade kernelUpgrade bpftool | Mar 17, 2026 | Mar 17, 2026 |
| Huawei Euleros 2_0_sp13 | — | Upgrade kernel-tools-libsUpgrade bpftoolUpgrade kernelUpgrade kernel-toolsUpgrade kernel-abi-stablelistsUpgrade python3-perf | Feb 3, 2026 | Feb 2, 2026 |
| Oracle_linux | — | Upgrade kernel-uekUpgrade kernel | Oct 14, 2025 | Jul 28, 2025 |
| Redhat_linux | — | Upgrade kernelNo solution existsUpgrade kernel-rt | Jul 31, 2025 | Jul 28, 2025 |
| Rocky_linux | — | Upgrade kernel-debug-devel-matchedUpgrade rvUpgrade kernel-rt-modules-coreUpgrade kernel-zfcpdumpUpgrade kernel-debug-modules-coreUpgrade kernel-debuginfo-common-s390xUpgrade kernel-debug-debuginfoUpgrade kernel-modules-extra-matchedUpgrade kernel-rt-modulesUpgrade kernel-tools-libs-develUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-devel-matchedUpgrade kernel-zfcpdump-modulesUpgrade kernel-rt-debug-modules-extraUpgrade kernel-rt-debuginfoUpgrade kernel-rt-debug-modules-coreUpgrade kernel-tools-libsUpgrade kernel-zfcpdump-coreUpgrade libperfUpgrade kernel-rt-debug-debuginfoUpgrade libperf-debuginfoUpgrade perf-debuginfoUpgrade kernel-debug-modulesUpgrade kernel-toolsUpgrade kernel-uki-virtUpgrade kernel-rtUpgrade kernel-debug-modules-extraUpgrade kernel-rt-debug-modulesUpgrade kernel-uki-virt-addonsUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-zfcpdump-devel-matchedUpgrade kernel-rt-modules-extraUpgrade python3-perfUpgrade kernel-coreUpgrade perfUpgrade kernel-tools-debuginfoUpgrade kernel-debug-develUpgrade kernel-debuginfoUpgrade kernel-zfcpdump-debuginfoUpgrade kernel-rt-debugUpgrade kernel-rt-develUpgrade kernelUpgrade kernel-debug-uki-virtUpgrade kernel-rt-debug-develUpgrade kernel-develUpgrade kernel-debugUpgrade python3-perf-debuginfoUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-rt-debug-coreUpgrade kernel-rt-coreUpgrade kernel-debug-coreUpgrade kernel-modules-extraUpgrade kernel-modules-coreUpgrade rtlaUpgrade kernel-zfcpdump-develUpgrade kernel-modules | Feb 5, 2026 | Nov 27, 2025 |
| Suse | — | Upgrade kernel-rt_debug-vdsoUpgrade cluster-md-kmp-defaultUpgrade dtb-renesasUpgrade dtb-sprdUpgrade kernel-debugUpgrade kselftests-kmp-rtUpgrade kernel-docsUpgrade dlm-kmp-defaultUpgrade kernel-default-livepatch-develUpgrade kernel-syms-rtUpgrade kernel-kvmsmallUpgrade ocfs2-kmp-rtUpgrade reiserfs-kmp-rtUpgrade kernel-rt-develUpgrade dtb-armUpgrade kernel-default-manUpgrade dlm-kmp-azureUpgrade dtb-mediatekUpgrade kernel-symsUpgrade kernel-macrosUpgrade dtb-rockchipUpgrade cluster-md-kmp-64kbUpgrade kernel-defaultUpgrade kernel-default-base-rebuildUpgrade dtb-xilinxUpgrade kernel-rt-livepatch-develUpgrade kernel-default-extraUpgrade dtb-amlogicUpgrade dtb-nvidiaUpgrade kernel-64kb-develUpgrade kselftests-kmp-defaultUpgrade kernel-azure-vdsoUpgrade dlm-kmp-rtUpgrade kernel-64kb-extraUpgrade kernel-obs-qaUpgrade kernel-devel-rtUpgrade reiserfs-kmp-azureUpgrade kernel-default-baseUpgrade reiserfs-kmp-defaultUpgrade dtb-socionextUpgrade dtb-apmUpgrade cluster-md-kmp-rtUpgrade dtb-exynosUpgrade dtb-hisiliconUpgrade kselftests-kmp-64kbUpgrade reiserfs-kmp-64kbUpgrade kernel-preemptUpgrade dtb-qcomUpgrade kernel-kvmsmall-develUpgrade kernel-docs-htmlUpgrade kernel-64kbUpgrade dtb-marvellUpgrade dtb-amdUpgrade kernel-source-azureUpgrade kernel-rt-optionalUpgrade kernel-kvmsmall-vdsoUpgrade kernel-debug-vdsoUpgrade gfs2-kmp-rtUpgrade dtb-freescaleUpgrade dtb-amazonUpgrade cluster-md-kmp-azureUpgrade ocfs2-kmp-defaultUpgrade kernel-preempt-develUpgrade kernel-obs-buildUpgrade kernel-devel-azureUpgrade kernel-default-optionalUpgrade kernel-default-livepatchUpgrade kernel-64kb-optionalUpgrade kernel-rt-extraUpgrade kernel-azure-extraUpgrade gfs2-kmp-azureUpgrade dtb-broadcomUpgrade kernel-azureUpgrade kernel-default-develUpgrade kernel-syms-azureUpgrade kernel-sourceUpgrade kernel-debug-develUpgrade ocfs2-kmp-64kbUpgrade kernel-rt-livepatchUpgrade kernel-zfcpdumpUpgrade kernel-source-vanillaUpgrade kernel-rt_debugUpgrade kernel-rt_debug-develUpgrade kernel-develUpgrade kernel-azure-develUpgrade dtb-alteraUpgrade gfs2-kmp-defaultUpgrade kernel-azure-optionalUpgrade gfs2-kmp-64kbUpgrade kernel-source-rtUpgrade ocfs2-kmp-azureUpgrade kernel-rt-vdsoUpgrade kernel-default-vdsoUpgrade dtb-caviumUpgrade dtb-appleUpgrade kselftests-kmp-azureUpgrade kernel-rtUpgrade dtb-lgUpgrade dtb-allwinnerUpgrade dlm-kmp-64kb | Dec 5, 2025 | Aug 18, 2025 |
| Ubuntu | — | Upgrade linux-image-5.15.0-1092-intel-iotgUpgrade linux-image-5.15.0-1092-nvidia-lowlatencyUpgrade linux-image-5.15.0-163-lowlatencyUpgrade linux-image-oem-20.04cUpgrade linux-image-raspi-realtime-6.8Upgrade linux-image-6.8.0-100-lowlatencyUpgrade linux-image-lowlatency-64kUpgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-nvidia-lowlatency-6.8Upgrade linux-image-nvidia-tegraUpgrade linux-image-6.8.0-1043-oracleUpgrade linux-image-gcp-fipsUpgrade linux-image-nvidia-tegra-5.15Upgrade linux-image-oracle-lts-24.04Upgrade linux-image-raspiUpgrade linux-image-gke-64kUpgrade linux-image-virtual-6.8Upgrade linux-image-virtual-hwe-24.04Upgrade linux-image-6.14.0-1017-azureUpgrade linux-image-6.8.0-1023-xilinxUpgrade linux-image-5.15.0-163-fipsUpgrade linux-image-6.8.0-1044-ibmUpgrade linux-image-oem-22.04Upgrade linux-image-xilinx-zynqmpUpgrade linux-image-6.8.0-1047-gcpUpgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-ibmUpgrade linux-image-gke-5.15Upgrade linux-image-nvidiaUpgrade linux-image-6.8.0-1046-nvidia-lowlatency-64kUpgrade linux-image-nvidia-tegra-rt-5.15Upgrade linux-image-aws-64k-lts-22.04Upgrade linux-image-5.15.0-1091-raspiUpgrade linux-image-6.8.0-1046-azureUpgrade linux-image-raspi-realtimeUpgrade linux-image-6.8.0-1046-azure-fipsUpgrade linux-image-intel-iotg-5.15Upgrade linux-image-nvidia-tegra-igx-rt-5.15Upgrade linux-image-raspi-6.14Upgrade linux-image-5.15.0-163-genericUpgrade linux-image-5.15.0-1097-aws-fipsUpgrade linux-image-azure-6.8Upgrade linux-image-oem-22.04cUpgrade linux-image-gke-64k-6.8Upgrade linux-image-gkeop-6.8Upgrade linux-image-6.8.0-100-lowlatency-64kUpgrade linux-image-gcpUpgrade linux-image-aws-64kUpgrade linux-image-azureUpgrade linux-image-raspi-6.8Upgrade linux-image-gcp-6.14Upgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-oracle-64k-lts-24.04Upgrade linux-image-raspi-5.15Upgrade linux-image-lowlatencyUpgrade linux-image-aws-fips-5.15Upgrade linux-image-aws-lts-22.04Upgrade linux-image-6.8.0-1051-azureUpgrade linux-image-intel-iot-realtimeUpgrade linux-image-5.15.0-1093-gkeUpgrade linux-image-6.14.0-1017-oracle-64kUpgrade linux-image-oracle-64k-6.8Upgrade linux-image-generic-64k-5.15Upgrade linux-image-gkeopUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-generic-lpaeUpgrade linux-image-oem-22.04aUpgrade linux-image-azure-fips-5.15Upgrade linux-image-gcp-64k-6.14Upgrade linux-image-gcp-fips-6.8Upgrade linux-image-oem-24.04Upgrade linux-image-generic-lpae-5.15Upgrade linux-image-ibm-classicUpgrade linux-image-intel-iotgUpgrade linux-image-lowlatency-5.15Upgrade linux-image-virtual-hwe-20.04Upgrade linux-image-intelUpgrade linux-image-5.15.0-1089-intel-iot-realtimeUpgrade linux-image-xilinx-6.8Upgrade linux-image-5.15.0-1096-realtimeUpgrade linux-image-oracle-64kUpgrade linux-image-5.15.0-1097-awsUpgrade linux-image-gcp-fips-5.15Upgrade linux-image-ibm-5.15Upgrade linux-image-nvidia-64kUpgrade linux-image-5.15.0-1102-azureUpgrade linux-image-oem-20.04bUpgrade linux-image-realtime-hwe-22.04Upgrade linux-image-oracle-64k-6.14Upgrade linux-image-6.8.0-1043-gkeUpgrade linux-image-generic-6.14Upgrade linux-image-virtual-hwe-22.04Upgrade linux-image-gke-6.8Upgrade linux-image-oem-24.04aUpgrade linux-image-generic-64kUpgrade linux-image-6.14.0-1016-oemUpgrade linux-image-aws-6.8Upgrade linux-image-gcp-64kUpgrade linux-image-gcp-lts-22.04Upgrade linux-image-nvidia-5.15Upgrade linux-image-aws-fipsUpgrade linux-image-realtime-5.15Upgrade linux-image-fipsUpgrade linux-image-realtime-6.8.1Upgrade linux-image-azure-lts-22.04Upgrade linux-image-6.8.0-1046-awsUpgrade linux-image-nvidia-tegra-igx-5.15Upgrade linux-image-realtime-hwe-24.04Upgrade linux-image-5.15.0-1049-nvidia-tegra-rtUpgrade linux-image-5.15.0-1080-gkeopUpgrade linux-image-genericUpgrade linux-image-5.15.0-163-generic-lpaeUpgrade linux-image-fips-5.15Upgrade linux-image-oracle-5.15Upgrade linux-image-xilinxUpgrade linux-image-6.8.0-100-genericUpgrade linux-image-azure-6.14Upgrade linux-image-5.15.0-1094-oracleUpgrade linux-image-azure-lts-24.04Upgrade linux-image-gcp-64k-lts-24.04Upgrade linux-image-kvm-5.15Upgrade linux-image-nvidia-6.8Upgrade linux-image-6.8.0-1046-nvidia-lowlatencyUpgrade linux-image-6.14.0-36-genericUpgrade linux-image-generic-hwe-20.04Upgrade linux-image-lowlatency-6.8Upgrade linux-image-xilinx-zynqmp-5.15Upgrade linux-image-aws-5.15Upgrade linux-image-raspi-nolpaeUpgrade linux-image-azure-fipsUpgrade linux-image-6.8.0-1047-gcp-64kUpgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-6.8.0-1047-raspiUpgrade linux-image-6.8.0-1043-oracle-64kUpgrade linux-image-gkeUpgrade linux-image-azure-5.15Upgrade linux-image-aws-lts-24.04Upgrade linux-image-aws-64k-6.14Upgrade linux-image-6.14.0-36-generic-64kUpgrade linux-image-5.15.0-1101-azureUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-5.15.0-1061-xilinx-zynqmpUpgrade linux-image-generic-64k-6.8Upgrade linux-image-5.15.0-1089-kvmUpgrade linux-image-awsUpgrade linux-image-realtime-6.14Upgrade linux-image-5.15.0-163-lowlatency-64kUpgrade linux-image-5.15.0-1038-nvidia-tegra-igx-rtUpgrade linux-image-oracle-6.14Upgrade linux-image-oem-6.14Upgrade linux-image-nvidia-lowlatencyUpgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-generic-6.8Upgrade linux-image-aws-fips-6.8Upgrade linux-image-6.8.0-1046-aws-fipsUpgrade linux-image-6.14.0-1020-gcp-64kUpgrade linux-image-6.14.0-1017-aws-64kUpgrade linux-image-5.15.0-163-generic-64kUpgrade linux-image-6.14.0-1016-realtimeUpgrade linux-image-5.15.0-1097-gcp-fipsUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-ibm-6.8Upgrade linux-image-gcp-lts-24.04Upgrade linux-image-5.15.0-1092-nvidiaUpgrade linux-image-6.8.0-1047-gcp-fipsUpgrade linux-image-gcp-5.15Upgrade linux-image-aws-64k-6.8Upgrade linux-image-nvidia-tegra-igx-rtUpgrade linux-image-oem-20.04dUpgrade linux-image-5.15.0-1091-ibmUpgrade linux-image-5.15.0-1097-gcpUpgrade linux-image-5.15.0-1049-nvidia-tegraUpgrade linux-image-virtual-5.15Upgrade linux-image-nvidia-64k-6.8Upgrade linux-image-intel-iot-realtime-5.15Upgrade linux-image-gcp-6.8Upgrade linux-image-aws-64k-5.15Upgrade linux-image-6.8.0-1046-nvidia-64kUpgrade linux-image-6.8.1-1041-realtimeUpgrade linux-image-6.8.0-1046-aws-64kUpgrade linux-image-6.8.0-1030-gkeopUpgrade linux-image-6.14.0-1017-awsUpgrade linux-image-virtualUpgrade linux-image-aws-64k-lts-24.04Upgrade linux-image-gkeop-5.15Upgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-6.8.0-100-fipsUpgrade linux-image-nvidia-lowlatency-5.15Upgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-lowlatency-64k-6.8Upgrade linux-image-5.15.0-1038-nvidia-tegra-igxUpgrade linux-image-virtual-6.14Upgrade linux-image-realtimeUpgrade linux-image-oracle-6.8Upgrade linux-image-oracleUpgrade linux-image-oracle-lts-22.04Upgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-6.8.0-100-generic-64kUpgrade linux-image-gcp-64k-6.8Upgrade linux-image-6.8.0-1046-nvidiaUpgrade linux-image-6.8.0-1043-gke-64kUpgrade linux-image-kvmUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-generic-hwe-22.04Upgrade linux-image-generic-64k-6.14Upgrade linux-image-azure-cvmUpgrade linux-image-aws-6.14Upgrade linux-image-azure-fips-6.8Upgrade linux-image-6.14.0-1017-oracleUpgrade linux-image-fips-6.8Upgrade linux-image-5.15.0-1097-aws-64kUpgrade linux-image-5.15.0-1101-azure-fipsUpgrade linux-image-oem-22.04bUpgrade linux-image-oem-22.04dUpgrade linux-image-6.14.0-1018-raspiUpgrade linux-image-nvidia-lowlatency-64k-6.8Upgrade linux-image-lowlatency-64k-5.15Upgrade linux-image-generic-5.15Upgrade linux-image-6.8.0-2037-raspi-realtimeUpgrade linux-image-6.14.0-1020-gcpUpgrade linux-image-oem-20.04Upgrade linux-image-nvidia-tegra-rtUpgrade linux-image-nvidia-tegra-igxUpgrade linux-image-nvidia-lowlatency-64k | Jul 31, 2025 | Jul 28, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Aug 20, 2025 | Jul 28, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub