In the Linux kernel, the following vulnerability has been resolved:
net/sched: Fix backlog accounting in qdisc_dequeue_internal
This issue applies for the following qdiscs: hhf, fq, fq_codel, and fq_pie, and occurs in their change handlers when adjusting to the new limit. The problem is the following in the values passed to the subsequent qdisc_tree_reduce_backlog call given a tbf parent:
When the tbf parent runs out of tokens, skbs of these qdiscs will be placed in gso_skb. Their peek handlers are qdisc_peek_dequeued, which accounts for both qlen and backlog. However, in the case of qdisc_dequeue_internal, ONLY qlen is accounted for when pulling from gso_skb. This means that these qdiscs are missing a qdisc_qstats_backlog_dec when dropping packets to satisfy the new limit in their change handlers.
One can observe this issue with the following (with tc patched to support a limit of 0):
export TARGET=fq tc qdisc del dev lo root tc qdisc add dev lo root handle 1: tbf rate 8bit burst 100b latency 1ms tc qdisc replace dev lo handle 3: parent 1:1 $TARGET limit 1000 echo ''; echo 'add child'; tc -s -d qdisc show dev lo ping -I lo -f -c2 -s32 -W0.001 127.0.0.1 2>&1 >/dev/null echo ''; echo 'after ping'; tc -s -d qdisc show dev lo tc qdisc change dev lo handle 3: parent 1:1 $TARGET limit 0 echo ''; echo 'after limit drop'; tc -s -d qdisc show dev lo tc qdisc replace dev lo handle 2: parent 1:1 sfq echo ''; echo 'post graft'; tc -s -d qdisc show dev lo
The second to last show command shows 0 packets but a positive number (74) of backlog bytes. The problem becomes clearer in the last show command, where qdisc_purge_queue triggers qdisc_tree_reduce_backlog with the positive backlog and causes an underflow in the tbf parent's backlog (4096 Mb instead of 0).
To fix this issue, the codepath for all clients of qdisc_dequeue_internal has been simplified: codel, pie, hhf, fq, fq_pie, and fq_codel. qdisc_dequeue_internal handles the backlog adjustments for all cases that do not directly use the dequeue handler.
The old fq_codel_change limit adjustment loop accumulated the arguments to the subsequent qdisc_tree_reduce_backlog call through the cstats field. However, this is confusing and error prone as fq_codel_dequeue could also potentially mutate this field (which qdisc_dequeue_internal calls in the non gso_skb case), so we have unified the code here with other qdiscs.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernel-livepatch-5.10.240-238.959Upgrade kernel-toolsUpgrade kernel-livepatch-5.10.244-240.965Upgrade python-perf-debuginfoUpgrade bpftool-debuginfoUpgrade kernel-headersUpgrade kernel-debuginfo-common-x86_64Upgrade kernelUpgrade kernel-livepatch-5.15.193-133.214Upgrade kernel-livepatch-5.10.240-238.966Upgrade perf-debuginfoUpgrade python-perfUpgrade kernel-tools-develUpgrade perfUpgrade kernel-debuginfoUpgrade kernel-livepatch-5.10.242-239.961Upgrade kernel-develUpgrade kernel-debuginfo-common-aarch64Upgrade bpftoolUpgrade kernel-livepatch-5.10.238-231.953Upgrade kernel-tools-debuginfoUpgrade kernel-livepatch-5.10.239-236.958Upgrade kernel-livepatch-5.10.240-238.955Upgrade kernel-livepatch-5.10.238-234.956 | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade kernel6.12-modules-extraUpgrade python3-perfUpgrade kernel6.12-modules-extra-commonUpgrade kernel6.12Upgrade kernel6.12-debuginfo-common-aarch64Upgrade kernel-livepatch-6.12.48-67.114Upgrade kernel6.12-tools-debuginfoUpgrade kernel-livepatch-6.12.46-66.121Upgrade kernel-livepatch-6.1.153-175.280Upgrade kernel6.12-libbpf-staticUpgrade perf-debuginfoUpgrade python3-perf6.12-debuginfoUpgrade bpftool6.12-debuginfoUpgrade kernel6.12-libbpf-debuginfoUpgrade kernel6.12-libbpfUpgrade kernel6.12-libbpf-develUpgrade perf6.12-debuginfoUpgrade kernel-tools-develUpgrade perfUpgrade kernel-libbpf-debuginfoUpgrade bpftool6.12Upgrade kernel-headersUpgrade kernel-modules-extra-commonUpgrade kernel-libbpfUpgrade python3-perf6.12Upgrade kernel6.12-debuginfo-common-x86_64Upgrade kernel6.12-toolsUpgrade perf6.12Upgrade kernel-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade bpftool-debuginfoUpgrade kernel6.12-headersUpgrade kernel-libbpf-develUpgrade kernelUpgrade kernel-debuginfo-common-x86_64Upgrade kernel6.12-debuginfoUpgrade kernel6.12-develUpgrade kernel-tools-debuginfoUpgrade kernel-modules-extraUpgrade kernel-libbpf-staticUpgrade python3-perf-debuginfoUpgrade kernel-toolsUpgrade bpftoolUpgrade kernel-develUpgrade kernel6.12-tools-devel | Sep 30, 2025 | Sep 5, 2025 |
| Redhat_linux | — | No solution exists | Jul 17, 2026 | Sep 5, 2025 |
| Suse | — | Upgrade kernel-macrosUpgrade kernel-rt_debug-develUpgrade kernel-syms-azureUpgrade kernel-rt-livepatch-develUpgrade kernel-docsUpgrade dtb-nvidiaUpgrade kernel-64kb-extraUpgrade kernel-devel-azureUpgrade dtb-rockchipUpgrade kernel-rt-extraUpgrade dtb-amlogicUpgrade kernel-obs-buildUpgrade gfs2-kmp-defaultUpgrade kernel-debug-vdsoUpgrade kernel-default-base-rebuildUpgrade kernel-azure-vdsoUpgrade kernel-default-manUpgrade kernel-rt-vdsoUpgrade kernel-kvmsmall-vdsoUpgrade kernel-syms-rtUpgrade kselftests-kmp-azureUpgrade cluster-md-kmp-64kbUpgrade dtb-sprdUpgrade kernel-azureUpgrade dlm-kmp-rtUpgrade kernel-rt_debug-vdsoUpgrade kernel-sourceUpgrade kernel-source-rtUpgrade kernel-rt-livepatchUpgrade kernel-rt-optionalUpgrade kernel-defaultUpgrade kernel-azure-develUpgrade reiserfs-kmp-64kbUpgrade dtb-exynosUpgrade kernel-source-vanillaUpgrade dtb-qcomUpgrade kselftests-kmp-defaultUpgrade dlm-kmp-azureUpgrade dtb-armUpgrade kernel-default-vdsoUpgrade reiserfs-kmp-azureUpgrade kernel-kvmsmallUpgrade gfs2-kmp-azureUpgrade kernel-rtUpgrade kernel-default-baseUpgrade dtb-lgUpgrade dtb-freescaleUpgrade dtb-apmUpgrade kernel-debug-develUpgrade kernel-rt_debugUpgrade kselftests-kmp-rtUpgrade kernel-rt-develUpgrade kernel-obs-qaUpgrade gfs2-kmp-64kbUpgrade dtb-amdUpgrade cluster-md-kmp-rtUpgrade kselftests-kmp-64kbUpgrade cluster-md-kmp-defaultUpgrade reiserfs-kmp-rtUpgrade dtb-amazonUpgrade kernel-azure-extraUpgrade dlm-kmp-defaultUpgrade kernel-develUpgrade ocfs2-kmp-azureUpgrade kernel-source-azureUpgrade dtb-marvellUpgrade kernel-64kbUpgrade kernel-default-develUpgrade ocfs2-kmp-defaultUpgrade dtb-hisiliconUpgrade cluster-md-kmp-azureUpgrade kernel-devel-rtUpgrade dtb-socionextUpgrade kernel-64kb-develUpgrade ocfs2-kmp-rtUpgrade kernel-zfcpdumpUpgrade kernel-symsUpgrade kernel-default-livepatch-develUpgrade kernel-debugUpgrade dtb-xilinxUpgrade dtb-broadcomUpgrade kernel-docs-htmlUpgrade kernel-default-optionalUpgrade kernel-64kb-optionalUpgrade dtb-renesasUpgrade dlm-kmp-64kbUpgrade dtb-allwinnerUpgrade ocfs2-kmp-64kbUpgrade gfs2-kmp-rtUpgrade dtb-caviumUpgrade reiserfs-kmp-defaultUpgrade kernel-azure-optionalUpgrade dtb-mediatekUpgrade dtb-appleUpgrade dtb-alteraUpgrade kernel-default-extraUpgrade kernel-kvmsmall-develUpgrade kernel-default-livepatch | Dec 5, 2025 | Oct 15, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub