In the Linux kernel, the following vulnerability has been resolved: net/sched: accept TCA_STAB only for root qdisc Most qdiscs maintain their backlog using qdisc_pkt_len(skb) on the assumption it i…
High CVSS 7.8
Summary
In the Linux kernel, the following vulnerability has been resolved: net/sched: accept TCA_STAB only for root qdisc Most qdiscs maintain their backlog using qdisc_pkt_len(skb) on the assumption it is invariant between the enqueue() and dequeue() handlers. Unfortunately syzbot can crash a host rather easily using a TBF + SFQ combination, with an STAB on SFQ [1] We can't support TCA_STAB on arbitrary level, this would require to maintain per-qdisc storage. [1] [ 88.796496] BUG: kernel NULL …
In-depth triage · Auto channel
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Affected products
- :
Sources
- NVD DATABASE
Original Links
- https://git.kernel.org/stable/c/1edf039ee01788ffc25625fe58a903ae2efa213e Patch
- https://git.kernel.org/stable/c/2acbb9539bc2284e30d2aeb789c3d96287014264
- https://git.kernel.org/stable/c/3cb7cf1540ddff5473d6baeb530228d19bc97b8a Patch
- https://git.kernel.org/stable/c/3dc6ee96473cc2962c6db4297d4631f261be150f Patch
- https://git.kernel.org/stable/c/76feedc74b90270390fbfdf74a2e944e96872363 Patch
- https://git.kernel.org/stable/c/8fb6503592d39065316f45d267c5527b4e7cd995 Patch
- https://git.kernel.org/stable/c/adbc3eef43fc94c7c8436da832691ae02333a972 Patch
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html
- https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html
- https://cert-portal.siemens.com/productcert/html/ssa-265688.html
- https://cert-portal.siemens.com/productcert/html/ssa-355557.html
Timeline
- nvd_ingest NVD