CVE-2025-39766

Advisory lineage Upstream: 0 Downstream: 53
Modified
Published: 11 Sept 2025, 16:56
Last modified:12 May 2026, 12:06

Vulnerability Summary

Overall Risk (default)
medium
31/100
CVSS Score
7.8 HIGH
v3.1 (nvd)
EPSS Score
0.02% LOW
0% probability 0.00%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

11 Sept 2025, 16:56
Published
Vulnerability first disclosed
12 May 2026, 12:06
Last Modified
Vulnerability information updated

Description

In the Linux kernel, the following vulnerability has been resolved: net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit The following setup can trigger a WARNING in htb_activate due to the condition: !cl->leaf.q->q.qlen tc qdisc del dev lo root tc qdisc add dev lo root handle 1: htb default 1 tc class add dev lo parent 1: classid 1:1 \ htb rate 64bit tc qdisc add dev lo parent 1:1 handle f: \ cake memlimit 1b ping -I lo -f -c1 -s64 -W0.001 127.0.0.1 This is because the low memlimit leads to a low buffer_limit, which causes packet dropping. However, cake_enqueue still returns NET_XMIT_SUCCESS, causing htb_enqueue to call htb_activate with an empty child qdisc. We should return NET_XMIT_CN when packets are dropped from the same tin and flow. I do not believe return value of NET_XMIT_CN is necessary for packet drops in the case of ack filtering, as that is meant to optimize performance, not to signal congestion.

CVSS Metrics

  • v3.1•HIGH•Score: 7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Trends

Current EPSS score: 0.02%• Percentile: 6%

Affected Systems

  • debian•debian_linux

    11.0

  • linux•linux

    ≥ 046f6fd5daefac7f5abdafb436b30f63bc7c602b, < 7689ab22de36f8db19095f6bdf11f28cfde92f5c | ≥ 046f6fd5daefac7f5abdafb436b30f63bc7c602b, < de04ddd2980b48caa8d7e24a7db2742917a8b280 | ≥ 046f6fd5daefac7f5abdafb436b30f63bc7c602b, < 0dacfc5372e314d1219f03e64dde3ab495a5a25e | ≥ 046f6fd5daefac7f5abdafb436b30f63bc7c602b, < 710866fc0a64eafcb8bacd91bcb1329eb7e5035f | ≥ 046f6fd5daefac7f5abdafb436b30f63bc7c602b, < aa12ee1c1bd260943fd6ab556d8635811c332eeb | ≥ 046f6fd5daefac7f5abdafb436b30f63bc7c602b, < ff57186b2cc39766672c4c0332323933e5faaa88 | ≥ 046f6fd5daefac7f5abdafb436b30f63bc7c602b, < 62d591dde4defb1333d202410609c4ddeae060b3 | ≥ 046f6fd5daefac7f5abdafb436b30f63bc7c602b, < 15de71d06a400f7fdc15bf377a2552b0ec437cf5 | 4.19

  • linux•linux_kernel

    ≥ 4.19, < 5.4.297 | ≥ 5.5, < 5.10.241 | ≥ 5.11, < 5.15.190 | ≥ 5.16, < 6.1.149 | ≥ 6.2, < 6.6.103 | ≥ 6.7, < 6.12.44 | ≥ 6.13, < 6.16.4 | 6.17:rc1 | 6.17:rc2

References (11)