In the Linux kernel, the following vulnerability has been resolved:
net/sched: ets: use old 'nbands' while purging unused classes
Shuang reported sch_ets test-case [1] crashing in ets_class_qlen_notify() after recent changes from Lion [2]. The problem is: in ets_qdisc_change() we purge unused DWRR queues; the value of 'q->nbands' is the new one, and the cleanup should be done with the old one. The problem is here since my first attempts to fix ets_qdisc_change(), but it surfaced again after the recent qdisc len accounting fixes. Fix it purging idle DWRR queues before assigning a new value of 'q->nbands', so that all purge operations find a consistent configuration:
- old 'q->nbands' because it's needed by ets_class_find() - old 'q->nstrict' because it's needed by ets_class_is_strict()
BUG: kernel NULL pointer dereference, address: 0000000000000000 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: Oops: 0000 [#1] SMP NOPTI CPU: 62 UID: 0 PID: 39457 Comm: tc Kdump: loaded Not tainted 6.12.0-116.el10.x86_64 #1 PREEMPT(voluntary) Hardware name: Dell Inc. PowerEdge R640/06DKY5, BIOS 2.12.2 07/09/2021 RIP: 0010:__list_del_entry_valid_or_report+0x4/0x80 Code: ff 4c 39 c7 0f 84 39 19 8e ff b8 01 00 00 00 c3 cc cc cc cc 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa <48> 8b 17 48 8b 4f 08 48 85 d2 0f 84 56 19 8e ff 48 85 c9 0f 84 ab RSP: 0018:ffffba186009f400 EFLAGS: 00010202 RAX: 00000000000000d6 RBX: 0000000000000000 RCX: 0000000000000004 RDX: ffff9f0fa29b69c0 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffffffc12c2400 R08: 0000000000000008 R09: 0000000000000004 R10: ffffffffffffffff R11: 0000000000000004 R12: 0000000000000000 R13: ffff9f0f8cfe0000 R14: 0000000000100005 R15: 0000000000000000 FS: 00007f2154f37480(0000) GS:ffff9f269c1c0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 00000001530be001 CR4: 00000000007726f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: <TASK> ets_class_qlen_notify+0x65/0x90 [sch_ets] qdisc_tree_reduce_backlog+0x74/0x110 ets_qdisc_change+0x630/0xa40 [sch_ets] __tc_modify_qdisc.constprop.0+0x216/0x7f0 tc_modify_qdisc+0x7c/0x120 rtnetlink_rcv_msg+0x145/0x3f0 netlink_rcv_skb+0x53/0x100 netlink_unicast+0x245/0x390 netlink_sendmsg+0x21b/0x470 ____sys_sendmsg+0x39d/0x3d0 ___sys_sendmsg+0x9a/0xe0 __sys_sendmsg+0x7a/0xd0 do_syscall_64+0x7d/0x160 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f2155114084 Code: 89 02 b8 ff ff ff ff eb bb 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa 80 3d 25 f0 0c 00 00 74 13 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 54 c3 0f 1f 00 48 83 ec 28 89 54 24 1c 48 89 RSP: 002b:00007fff1fd7a988 EFLAGS: 00000202 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 0000560ec063e5e0 RCX: 00007f2155114084 RDX: 0000000000000000 RSI: 00007fff1fd7a9f0 RDI: 0000000000000003 RBP: 00007fff1fd7aa60 R08: 0000000000000010 R09: 000000000000003f R10: 0000560ee9b3a010 R11: 0000000000000202 R12: 00007fff1fd7aae0 R13: 000000006891ccde R14: 0000560ec063e5e0 R15: 00007fff1fd7aad0 </TASK>
[1] https://lore.kernel.org/netdev/e08c7f4a6882f260011909a868311c6e9b54f3e4.1639153474.git.dcaratti@redhat.com/ [2] https://lore.kernel.org/netdev/[email protected]/
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-64k-modulesUpgrade kernel-debug-develUpgrade kernel-rt-64k-debug-modules-coreUpgrade kernel-cross-headersUpgrade kernel-rt-64k-modules-extraUpgrade kernel-debug-coreUpgrade kernel-64k-debug-coreUpgrade kernel-rt-debug-develUpgrade kernel-tools-libsUpgrade kernel-rt-coreUpgrade kernel-rt-64k-debug-modules-extraUpgrade kernel-64k-modules-coreUpgrade kernel-modules-extraUpgrade kernel-headersUpgrade kernel-debug-uki-virtUpgrade kernel-zfcpdump-develUpgrade kernel-zfcpdump-modules-extraUpgrade kernelUpgrade kernel-rt-debug-coreUpgrade kernel-64k-develUpgrade kernel-rt-64k-debugUpgrade kernel-debug-modulesUpgrade kernel-modulesUpgrade python3-perfUpgrade kernel-64kUpgrade kernel-devel-matchedUpgrade kernel-64k-debug-modules-extraUpgrade kernel-coreUpgrade libperfUpgrade kernel-abi-stablelistsUpgrade kernel-rt-modules-extraUpgrade kernel-64k-coreUpgrade kernel-rt-64k-modulesUpgrade kernel-rt-debug-kvmUpgrade rtlaUpgrade kernel-debug-devel-matchedUpgrade kernel-debugUpgrade kernel-rt-64k-coreUpgrade kernel-modules-coreUpgrade kernel-rt-64k-debug-modulesUpgrade kernel-zfcpdumpUpgrade kernel-64k-debug-modulesUpgrade perfUpgrade kernel-develUpgrade kernel-64k-devel-matchedUpgrade kernel-debug-modules-extraUpgrade kernel-rt-64k-modules-coreUpgrade kernel-uki-virtUpgrade kernel-uki-virt-addonsUpgrade kernel-64k-debugUpgrade kernel-rt-modules-coreUpgrade kernel-rt-kvmUpgrade rvUpgrade kernel-rtUpgrade kernel-debug-modules-coreUpgrade kernel-64k-debug-modules-coreUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-rt-debug-modulesUpgrade kernel-tools-libs-develUpgrade kernel-rt-debug-modules-extraUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-rt-debug-modules-coreUpgrade kernel-rt-modulesUpgrade kernel-64k-modules-extraUpgrade kernel-zfcpdump-coreUpgrade kernel-64k-debug-devel-matchedUpgrade kernel-rt-64k-develUpgrade kernel-rt-64k-debug-coreUpgrade kernel-64k-debug-develUpgrade kernel-zfcpdump-modulesUpgrade kernel-rt-64k-debug-develUpgrade kernel-rt-64kUpgrade kernel-docUpgrade kernel-rt-debugUpgrade kernel-toolsUpgrade kernel-rt-devel | Sep 30, 2025 | Sep 2, 2025 |
| Amazon Linux Ami 2 | — | Upgrade kernel-debuginfoUpgrade kernel-toolsUpgrade perfUpgrade kernel-tools-develUpgrade kernel-develUpgrade kernel-tools-debuginfoUpgrade bpftoolUpgrade kernel-debuginfo-common-aarch64Upgrade bpftool-debuginfoUpgrade kernel-livepatch-5.10.242-239.961Upgrade python-perf-debuginfoUpgrade kernelUpgrade kernel-debuginfo-common-x86_64Upgrade perf-debuginfoUpgrade python-perfUpgrade kernel-headers | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade python3-perfUpgrade kernel-debuginfoUpgrade kernel-modules-extra-commonUpgrade kernel-headersUpgrade kernel-livepatch-6.1.150-174.273Upgrade kernel-libbpf-debuginfoUpgrade perfUpgrade perf-debuginfoUpgrade kernel-tools-develUpgrade kernel-modules-extraUpgrade kernel-libbpf-develUpgrade python3-perf-debuginfoUpgrade kernel-libbpf-staticUpgrade kernelUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-libbpfUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-tools-debuginfoUpgrade kernel-toolsUpgrade bpftool-debuginfoUpgrade bpftoolUpgrade kernel-devel | Sep 30, 2025 | Sep 4, 2025 |
| Debian | — | Upgrade linux-6.1Upgrade linux | Sep 25, 2025 | Sep 25, 2025 |
| Oracle_linux | — | Upgrade kernel-uek | Oct 16, 2025 | Sep 4, 2025 |
| Redhat_linux | — | No solution existsUpgrade kernel-rtUpgrade kernel | Sep 23, 2025 | Sep 4, 2025 |
| Suse | — | Upgrade kernel-kvmsmallUpgrade ocfs2-kmp-rtUpgrade reiserfs-kmp-azureUpgrade reiserfs-kmp-rtUpgrade dlm-kmp-azureUpgrade dtb-amdUpgrade kernel-docsUpgrade kernel-azure-vdsoUpgrade reiserfs-kmp-defaultUpgrade cluster-md-kmp-azureUpgrade kernel-obs-qaUpgrade kernel-rt-develUpgrade dtb-armUpgrade kselftests-kmp-defaultUpgrade kernel-64kb-develUpgrade kernel-develUpgrade gfs2-kmp-64kbUpgrade kernel-devel-rtUpgrade kernel-symsUpgrade cluster-md-kmp-defaultUpgrade dtb-socionextUpgrade cluster-md-kmp-rtUpgrade dtb-mediatekUpgrade dtb-apmUpgrade kernel-64kbUpgrade kernel-debugUpgrade kernel-default-extraUpgrade kernel-debug-develUpgrade kernel-devel-azureUpgrade dtb-hisiliconUpgrade kernel-kvmsmall-develUpgrade kernel-zfcpdumpUpgrade kselftests-kmp-rtUpgrade gfs2-kmp-rtUpgrade kernel-rt-livepatchUpgrade dlm-kmp-defaultUpgrade dtb-amlogicUpgrade dtb-xilinxUpgrade kernel-default-optionalUpgrade kernel-syms-azureUpgrade kernel-rt-livepatch-develUpgrade kernel-64kb-optionalUpgrade kernel-macrosUpgrade kernel-rt_debug-vdsoUpgrade ocfs2-kmp-64kbUpgrade kernel-syms-rtUpgrade kernel-rtUpgrade dtb-caviumUpgrade dtb-renesasUpgrade kernel-default-develUpgrade dtb-amazonUpgrade kernel-rt-optionalUpgrade kernel-docs-htmlUpgrade kernel-defaultUpgrade kernel-debug-vdsoUpgrade gfs2-kmp-azureUpgrade gfs2-kmp-defaultUpgrade kernel-azure-extraUpgrade kernel-azure-develUpgrade dtb-exynosUpgrade dlm-kmp-64kbUpgrade cluster-md-kmp-64kbUpgrade kernel-source-rtUpgrade kernel-sourceUpgrade kernel-rt_debug-develUpgrade dtb-appleUpgrade dtb-rockchipUpgrade kernel-64kb-extraUpgrade dtb-sprdUpgrade reiserfs-kmp-64kbUpgrade kernel-source-azureUpgrade kernel-default-base-rebuildUpgrade kernel-default-livepatchUpgrade dtb-qcomUpgrade dtb-freescaleUpgrade kernel-obs-buildUpgrade kernel-default-baseUpgrade dlm-kmp-rtUpgrade kernel-default-vdsoUpgrade kernel-default-livepatch-develUpgrade kselftests-kmp-64kbUpgrade kernel-rt-extraUpgrade ocfs2-kmp-defaultUpgrade kernel-azureUpgrade dtb-nvidiaUpgrade kernel-azure-optionalUpgrade kernel-source-vanillaUpgrade kselftests-kmp-azureUpgrade dtb-lgUpgrade dtb-broadcomUpgrade dtb-allwinnerUpgrade kernel-rt-vdsoUpgrade dtb-marvellUpgrade kernel-rt_debugUpgrade kernel-kvmsmall-vdsoUpgrade ocfs2-kmp-azureUpgrade dtb-altera | Dec 5, 2025 | Oct 15, 2025 |
| Ubuntu | — | Upgrade linux-image-raspi-5.15Upgrade linux-image-5.15.0-1097-awsUpgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-6.8.0-100-lowlatencyUpgrade linux-image-5.15.0-163-lowlatencyUpgrade linux-image-raspi-6.8Upgrade linux-image-nvidia-tegraUpgrade linux-image-virtual-6.8Upgrade linux-image-gcp-fipsUpgrade linux-image-nvidia-tegra-igx-5.15Upgrade linux-image-genericUpgrade linux-image-6.8.0-1046-nvidia-lowlatencyUpgrade linux-image-gke-64k-6.8Upgrade linux-image-oracle-lts-24.04Upgrade linux-image-aws-6.8Upgrade linux-image-6.8.1-1041-realtimeUpgrade linux-image-lowlatencyUpgrade linux-image-gkeopUpgrade linux-image-ibmUpgrade linux-image-virtual-hwe-22.04Upgrade linux-image-6.8.0-1044-ibmUpgrade linux-image-azure-5.15Upgrade linux-image-6.8.0-1046-aws-fipsUpgrade linux-image-5.15.0-1038-nvidia-tegra-igx-rtUpgrade linux-image-5.15.0-163-generic-lpaeUpgrade linux-image-oracle-5.15Upgrade linux-image-intel-iotg-5.15Upgrade linux-image-nvidia-lowlatency-6.8Upgrade linux-image-nvidia-tegra-rt-5.15Upgrade linux-image-oem-22.04aUpgrade linux-image-lowlatency-6.8Upgrade linux-image-aws-fips-5.15Upgrade linux-image-azure-fipsUpgrade linux-image-6.8.0-100-genericUpgrade linux-image-gke-6.8Upgrade linux-image-raspiUpgrade linux-image-nvidia-tegra-5.15Upgrade linux-image-nvidia-lowlatency-5.15Upgrade linux-image-oracle-64k-6.8Upgrade linux-image-generic-6.8Upgrade linux-image-6.8.0-1051-azureUpgrade linux-image-5.15.0-163-generic-64kUpgrade linux-image-6.8.0-1046-azureUpgrade linux-image-5.15.0-1094-oracleUpgrade linux-image-nvidia-6.8Upgrade linux-image-5.15.0-1049-nvidia-tegra-rtUpgrade linux-image-5.15.0-1101-azureUpgrade linux-image-realtime-6.8.1Upgrade linux-image-6.8.0-1023-xilinxUpgrade linux-image-aws-fipsUpgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-5.15.0-1080-gkeopUpgrade linux-image-5.15.0-1102-azureUpgrade linux-image-oracle-64k-lts-24.04Upgrade linux-image-6.8.0-1043-gkeUpgrade linux-image-oem-20.04bUpgrade linux-image-gke-64kUpgrade linux-image-5.15.0-1091-raspiUpgrade linux-image-6.8.0-1043-oracle-64kUpgrade linux-image-gkeop-6.8Upgrade linux-image-oracle-6.8Upgrade linux-image-virtual-hwe-20.04Upgrade linux-image-generic-64k-5.15Upgrade linux-image-oracle-64kUpgrade linux-image-realtime-5.15Upgrade linux-image-ibm-6.8Upgrade linux-image-gcp-fips-5.15Upgrade linux-image-lowlatency-64kUpgrade linux-image-oem-20.04cUpgrade linux-image-intel-iot-realtime-5.15Upgrade linux-image-nvidiaUpgrade linux-image-gcp-fips-6.8Upgrade linux-image-generic-hwe-20.04Upgrade linux-image-ibm-lts-24.04Upgrade linux-image-nvidia-lowlatencyUpgrade linux-image-azure-lts-22.04Upgrade linux-image-azure-lts-24.04Upgrade linux-image-6.8.0-1046-awsUpgrade linux-image-gcp-64kUpgrade linux-image-6.8.0-1043-gke-64kUpgrade linux-image-6.8.0-1046-nvidia-lowlatency-64kUpgrade linux-image-oem-22.04Upgrade linux-image-ibm-5.15Upgrade linux-image-kvm-5.15Upgrade linux-image-gke-5.15Upgrade linux-image-aws-lts-22.04Upgrade linux-image-raspi-realtime-6.8Upgrade linux-image-6.8.0-1047-raspiUpgrade linux-image-generic-hwe-22.04Upgrade linux-image-intelUpgrade linux-image-nvidia-64kUpgrade linux-image-xilinx-6.8Upgrade linux-image-ibm-classicUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-oem-22.04bUpgrade linux-image-oem-22.04cUpgrade linux-image-oem-22.04dUpgrade linux-image-nvidia-5.15Upgrade linux-image-5.15.0-163-fipsUpgrade linux-image-aws-64k-6.8Upgrade linux-image-generic-64kUpgrade linux-image-6.8.0-1047-gcp-fipsUpgrade linux-image-azureUpgrade linux-image-6.8.0-1043-oracleUpgrade linux-image-5.15.0-1093-gkeUpgrade linux-image-generic-64k-6.8Upgrade linux-image-5.15.0-1089-kvmUpgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-nvidia-64k-6.8Upgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-xilinxUpgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-intel-iotgUpgrade linux-image-gkeop-5.15Upgrade linux-image-gcp-6.8Upgrade linux-image-azure-cvmUpgrade linux-image-azure-6.8Upgrade linux-image-aws-lts-24.04Upgrade linux-image-lowlatency-64k-5.15Upgrade linux-image-5.15.0-163-lowlatency-64kUpgrade linux-image-5.15.0-1096-realtimeUpgrade linux-image-xilinx-zynqmpUpgrade linux-image-6.8.0-100-fipsUpgrade linux-image-5.15.0-163-genericUpgrade linux-image-azure-fips-6.8Upgrade linux-image-6.8.0-1046-azure-fipsUpgrade linux-image-5.15.0-1089-intel-iot-realtimeUpgrade linux-image-oracle-lts-22.04Upgrade linux-image-oem-20.04dUpgrade linux-image-lowlatency-64k-6.8Upgrade linux-image-gkeUpgrade linux-image-5.15.0-1097-gcp-fipsUpgrade linux-image-fipsUpgrade linux-image-6.8.0-1030-gkeopUpgrade linux-image-intel-iot-realtimeUpgrade linux-image-5.15.0-1049-nvidia-tegraUpgrade linux-image-generic-lpaeUpgrade linux-image-virtual-5.15Upgrade linux-image-gcp-64k-lts-24.04Upgrade linux-image-raspi-realtimeUpgrade linux-image-xilinx-zynqmp-5.15Upgrade linux-image-6.8.0-1046-aws-64kUpgrade linux-image-virtualUpgrade linux-image-aws-64k-5.15Upgrade linux-image-aws-5.15Upgrade linux-image-aws-64k-lts-22.04Upgrade linux-image-awsUpgrade linux-image-realtimeUpgrade linux-image-oem-20.04Upgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-gcp-64k-6.8Upgrade linux-image-6.8.0-1046-nvidiaUpgrade linux-image-gcp-lts-22.04Upgrade linux-image-generic-5.15Upgrade linux-image-6.8.0-2037-raspi-realtimeUpgrade linux-image-aws-64kUpgrade linux-image-5.15.0-1097-gcpUpgrade linux-image-6.8.0-1047-gcpUpgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-5.15.0-1092-intel-iotgUpgrade linux-image-6.8.0-100-generic-64kUpgrade linux-image-generic-lpae-5.15Upgrade linux-image-lowlatency-5.15Upgrade linux-image-nvidia-tegra-igxUpgrade linux-image-5.15.0-1038-nvidia-tegra-igxUpgrade linux-image-oracleUpgrade linux-image-5.15.0-1097-aws-fipsUpgrade linux-image-5.15.0-1091-ibmUpgrade linux-image-aws-fips-6.8Upgrade linux-image-6.8.0-1047-gcp-64kUpgrade linux-image-gcp-5.15Upgrade linux-image-aws-64k-lts-24.04Upgrade linux-image-nvidia-tegra-igx-rtUpgrade linux-image-nvidia-lowlatency-64k-6.8Upgrade linux-image-5.15.0-1061-xilinx-zynqmpUpgrade linux-image-realtime-hwe-22.04Upgrade linux-image-5.15.0-1092-nvidiaUpgrade linux-image-6.8.0-100-lowlatency-64kUpgrade linux-image-gcpUpgrade linux-image-azure-fips-5.15Upgrade linux-image-5.15.0-1101-azure-fipsUpgrade linux-image-6.8.0-1046-nvidia-64kUpgrade linux-image-nvidia-tegra-rtUpgrade linux-image-5.15.0-1097-aws-64kUpgrade linux-image-raspi-nolpaeUpgrade linux-image-5.15.0-1092-nvidia-lowlatencyUpgrade linux-image-kvmUpgrade linux-image-gcp-lts-24.04Upgrade linux-image-fips-6.8Upgrade linux-image-fips-5.15Upgrade linux-image-nvidia-tegra-igx-rt-5.15Upgrade linux-image-generic-64k-hwe-22.04 | Dec 5, 2025 | Sep 4, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Sep 19, 2025 | Sep 4, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub