CVE-2025-68325

net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop

State: Published
Severity: Not scored
Published: Dec 18, 2025
Updated: May 23, 2026
Reserved: Dec 16, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop

In cake_drop(), qdisc_tree_reduce_backlog() is used to update the qlen and backlog of the qdisc hierarchy. Its caller, cake_enqueue(), assumes that the parent qdisc will enqueue the current packet. However, this assumption breaks when cake_enqueue() returns NET_XMIT_CN: the parent qdisc stops enqueuing current packet, leaving the tree qlen/backlog accounting inconsistent. This mismatch can lead to a NULL dereference (e.g., when the parent Qdisc is qfq_qdisc).

This patch computes the qlen/backlog delta in a more robust way by observing the difference before and after the series of cake_drop() calls, and then compensates the qdisc tree accounting if cake_enqueue() returns NET_XMIT_CN.

To ensure correct compensation when ACK thinning is enabled, a new variable is introduced to keep qlen unchanged.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	de04ddd2980b48caa8d7e24a7db2742917a8b280 to before a3f4e3de41a3f115db35276c6b186ccbc913934aAffected 0dacfc5372e314d1219f03e64dde3ab495a5a25e to before 38abf6e931b169ea88d7529b49096f53a5dcf8feAffected 710866fc0a64eafcb8bacd91bcb1329eb7e5035f to before fcb91be52eb6e92e00b533ebd7c77fecada537e1Affected aa12ee1c1bd260943fd6ab556d8635811c332eeb to before d01f0e072dadb02fe10f436b940dd957aff0d7d4Affected ff57186b2cc39766672c4c0332323933e5faaa88 to before 0b6216f9b3d1c33c76f74511026e5de5385ee520Affected 15de71d06a400f7fdc15bf377a2552b0ec437cf5 to before 529c284cc2815c8350860e9a31722050fe7117cbAffected 15de71d06a400f7fdc15bf377a2552b0ec437cf5 to before 3ed6c458530a547ed0c9ea0b02b19bab620be88bAffected 15de71d06a400f7fdc15bf377a2552b0ec437cf5 to before 9fefc78f7f02d71810776fdeb119a05a946a27ccAffected 7689ab22de36f8db19095f6bdf11f28cfde92f5cAffected 62d591dde4defb1333d202410609c4ddeae060b3Affected 5.10.241 to before 5.10.248Affected 5.15.190 to before 5.15.198Affected 6.1.149 to before 6.1.160Affected 6.6.103 to before 6.6.120Affected 6.12.44 to before 6.12.63Affected 5.4.297 to before 5.5Affected 6.16.4 to before 6.17Affected
LinuxLinux	6.17Affected before 6.17Not affected 5.10.248 through 5.10.Not affected 5.15.198 through 5.15.Not affected 6.1.160 through 6.1.Not affected 6.6.120 through 6.6.Not affected 6.12.63 through 6.12.Not affected 6.17.13 through 6.17.Not affected 6.18.2 through 6.18.*Not affected 6.19 and laterNot affected

Product

Versions

LinuxLinux

de04ddd2980b48caa8d7e24a7db2742917a8b280 to before a3f4e3de41a3f115db35276c6b186ccbc913934aAffected
0dacfc5372e314d1219f03e64dde3ab495a5a25e to before 38abf6e931b169ea88d7529b49096f53a5dcf8feAffected
710866fc0a64eafcb8bacd91bcb1329eb7e5035f to before fcb91be52eb6e92e00b533ebd7c77fecada537e1Affected
aa12ee1c1bd260943fd6ab556d8635811c332eeb to before d01f0e072dadb02fe10f436b940dd957aff0d7d4Affected
ff57186b2cc39766672c4c0332323933e5faaa88 to before 0b6216f9b3d1c33c76f74511026e5de5385ee520Affected
15de71d06a400f7fdc15bf377a2552b0ec437cf5 to before 529c284cc2815c8350860e9a31722050fe7117cbAffected
15de71d06a400f7fdc15bf377a2552b0ec437cf5 to before 3ed6c458530a547ed0c9ea0b02b19bab620be88bAffected
15de71d06a400f7fdc15bf377a2552b0ec437cf5 to before 9fefc78f7f02d71810776fdeb119a05a946a27ccAffected
7689ab22de36f8db19095f6bdf11f28cfde92f5cAffected
62d591dde4defb1333d202410609c4ddeae060b3Affected
5.10.241 to before 5.10.248Affected
5.15.190 to before 5.15.198Affected
6.1.149 to before 6.1.160Affected
6.6.103 to before 6.6.120Affected
6.12.44 to before 6.12.63Affected
5.4.297 to before 5.5Affected
6.16.4 to before 6.17Affected

LinuxLinux

6.17Affected
before 6.17Not affected
5.10.248 through 5.10.*Not affected
5.15.198 through 5.15.*Not affected
6.1.160 through 6.1.*Not affected
6.6.120 through 6.6.*Not affected
6.12.63 through 6.12.*Not affected
6.17.13 through 6.17.*Not affected
6.18.2 through 6.18.*Not affected
6.19 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.