Security tracker / CVE-2025-39677

CVE-2025-39677

net/sched: Fix backlog accounting in qdisc_dequeue_internal

References

• Debian security tracker
• cve.org

Notes

 carnil> Introduced in 2d3cbfd6d54a ("net_sched: Flush gso_skb list too during
 carnil> ->change()")
 carnil> 4b549a2ef4be ("fq_codel: Fair Queue Codel AQM")
 carnil> 10239edf86f1 ("net-qdisc-hhf: Heavy-Hitter Filter (HHF) qdisc"). Vulnerable
 carnil> versions: 3.5.

Bugs

Status

Branch	Status
upstream	released (6.17-rc3) [52bf272636bda69587952b35ae97690b8dc89941]
7.2-upstream-stable	N/A "Fixed before branching point"
7.1-upstream-stable	N/A "Fixed before branching point"
7.0-upstream-stable	N/A "Fixed before branching point"
6.19-upstream-stable	N/A "Fixed before branching point"
6.18-upstream-stable	N/A "Fixed before branching point"
6.17-upstream-stable	N/A "Fixed before branching point"
6.16-upstream-stable	released (6.16.4) [a225f44d84b8900d679c5f5a9ea46fe9c0cc7802]
6.12-upstream-stable	released (6.12.114) [38cdf8d1f5f3ee133f6e48dd422df4057fa9bfcb]
6.6-upstream-stable	released (6.6.160) [dcfed7251e23cd71d32c4ecc444ff97992087e46]
6.1-upstream-stable	released (6.1.191) [65d1b5d84a0d697e9cfcdd0e07aad1bf1cb96295]
5.10-upstream-stable	needed
sid	released (6.16.5-1)
6.12-trixie-security	released (6.12.115-1)
6.1-bookworm-security	needed
5.10-bullseye-security	needed