CVE-2025-37992 in Linux
Summary
by MITRE • 05/26/2025
In the Linux kernel, the following vulnerability has been resolved:
net_sched: Flush gso_skb list too during ->change()
Previously, when reducing a qdisc's limit via the ->change() operation, only the main skb queue was trimmed, potentially leaving packets in the gso_skb list. This could result in NULL pointer dereference when we only check sch->limit against sch->q.qlen.
This patch introduces a new helper, qdisc_dequeue_internal(), which ensures both the gso_skb list and the main queue are properly flushed when trimming excess packets. All relevant qdiscs (codel, fq, fq_codel, fq_pie, hhf, pie) are updated to use this helper in their ->change() routines.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 12/16/2025
The vulnerability described in CVE-2025-37992 represents a critical flaw in the Linux kernel's networking subsystem, specifically within the traffic control framework that manages packet scheduling queues. This issue affects the net_sched component responsible for handling packet queuing disciplines, which are fundamental to network traffic management and quality of service implementations. The vulnerability stems from an incomplete cleanup operation during qdisc limit adjustments, creating a potential for system instability and denial of service conditions. According to CWE-476, this represents a null pointer dereference vulnerability that can occur when memory management operations fail to properly handle reference counting and queue state transitions. The flaw manifests when qdisc limits are reduced through the change() operation, which is a common administrative function used to adjust network queue parameters dynamically.
The technical implementation flaw occurs within the qdisc change() method where the kernel fails to properly flush all packet queues when reducing queue limits. Specifically, while the main skb queue is correctly trimmed to respect the new limit, packets remaining in the gso_skb list - which contains Generic Segmentation Offload packets that have been fragmented but not yet transmitted - are not properly removed. This creates a scenario where the system maintains references to packets that should no longer exist in the queue structure, leading to potential null pointer dereferences when subsequent queue operations attempt to access these dangling references. The issue is particularly dangerous because it occurs during normal administrative operations and can be triggered by any network configuration change that reduces qdisc limits. The ATT&CK framework categorizes this under T1499.004 for network denial of service, as it can be exploited to cause system instability through legitimate queue management operations.
The operational impact of this vulnerability extends beyond simple system crashes, affecting network reliability and availability in production environments where dynamic qdisc adjustments are common. Network administrators performing routine maintenance tasks such as bandwidth limit adjustments, queue parameter tuning, or traffic shaping modifications could inadvertently trigger this condition. The affected qdisc implementations include several widely-used packet scheduling algorithms such as codel, fq, fq_codel, fq_pie, hhf, and pie, which are integral to modern network stack operations and are employed across various server and network infrastructure deployments. When triggered, the vulnerability can result in kernel oops messages, system panics, or more subtle memory corruption that may lead to progressive network performance degradation. The patch addresses this by introducing a new helper function qdisc_dequeue_internal() that ensures comprehensive queue cleanup during limit changes, maintaining consistency between the main packet queue and the gso_skb list. This fix requires updates to all affected qdisc implementations to properly utilize the new helper function during their change() method execution, ensuring that both queue structures are consistently maintained during limit modifications. The resolution aligns with best practices for kernel memory management and queue consistency, preventing the scenario where packet references become stale during queue state transitions.