Listen to this Post
How the CVE Works
The vulnerability exists in the Linux kernel’s network scheduling (net_sched) subsystem. Queueing disciplines (qdiscs) like `fq` or `pie` manage packet transmission using a main queue and a separate `gso_skb` list for large packets segmented via Generic Segment Offload (GSO). The bug was triggered in the `->change()` operation function, which adjusts a qdisc’s queue size limit.
When an administrator reduced the queue limit using tools like tc, the kernel’s trimming logic only flushed packets from the main `skb` queue. If GSO packets resided in the `gso_skb` list, they were incorrectly left behind. This created an inconsistent state where the kernel’s internal accounting (sch->q.qlen) showed the queue was under the new limit, but the `gso_skb` list still held excess packets.
Subsequent kernel code, which checks the limit against the queue length, could then attempt to access a packet from the `gso_skb` list that was assumed to be empty or invalid. This led to a NULL pointer dereference, a type of memory corruption fault where the kernel tries to read from address 0x0. The result is a kernel panic or system crash, causing a denial of service.
The patch fixed this by introducing a new helper function, qdisc_dequeue_internal(). This function ensures both the main queue and the `gso_skb` list are properly flushed and accounted for during limit changes, eliminating the state inconsistency.
DailyCVE Form
Platform: Linux Kernel
Version: Affects multiple
Vulnerability: NULL pointer dereference
Severity: MEDIUM
Date: 05/26/2025
Prediction: 2025-07-08
What Undercode Say:
Analytics
Check current kernel version uname -r List network interfaces and their qdiscs tc qdisc show Example: Change the limit for a qdisc (triggering condition) tc qdisc change dev eth0 root fq limit 500
// Simplified example of the vulnerable pattern in a qdisc's change() function
static int example_qdisc_change(struct Qdisc sch, struct nlattr opt)
{
// ... parse new limit ...
while (sch->q.qlen > sch->limit) {
skb = qdisc_dequeue(&sch->q); // Only dequeues from main queue
kfree_skb(skb);
}
// gso_skb list was not flushed, causing inconsistency
}
How Exploit
An attacker with local user privileges (often required to execute `tc` commands) can trigger the flaw. They must force the creation of GSO packets on a network interface using a managed qdisc (like `fq_codel` or pie). Then, while packets are queued, they repeatedly execute a command to reduce the qdisc’s queue limit (tc qdisc change... limit [low value]). This sequence can cause the kernel to dereference a NULL pointer, leading to a system crash and denial of service.
Protection from this CVE
Apply kernel patches containing the helper function qdisc_dequeue_internal(). Update to a fixed kernel version provided by your distribution. For example, SUSE released fixes starting 2025-07-08. As a workaround, avoid dynamically reducing the `limit` parameter of the affected qdiscs (codel, fq, fq_codel, fq_pie, hhf, pie) in production environments.
Impact
The primary impact is a local denial of service (DoS) through a kernel panic, rendering the system unusable. The CVSS score rates Availability impact as High. There is no impact on confidentiality or integrity—the attack cannot leak data or gain elevated privileges. The affected scope is local (AV:L), meaning the attacker must have shell access to the target machine.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
