In the Linux kernel, the following vulnerability has been resolved:
net/sched: Restrict conditions for adding duplicating netems to qdisc tree
netemenqueue's duplication prevention logic breaks when a netem resides in a qdisc tree with other netems - this can lead to a soft lockup and OOM loop in netemdequeue, as seen in [1]. Ensure that a duplicating netem cannot exist in a tree with other netems.
Previous approaches suggested in discussions in chronological order:
1) Track duplication status or ttl in the sk_buff struct. Considered too specific a use case to extend such a struct, though this would be a resilient fix and address other previous and potential future DOS bugs like the one described in loopy fun [2].
2) Restrict netemenqueue recursion depth like in actmirred with a per cpu variable. However, netem_dequeue can call enqueue on its child, and the depth restriction could be bypassed if the child is a netem.
3) Use the same approach as in 2, but add metadata in netemskbcb to handle the netem_dequeue case and track a packet's involvement in duplication. This is an overly complex approach, and Jamal notes that the skb cb can be overwritten to circumvent this safeguard.
4) Prevent the addition of a netem to a qdisc tree if its ancestral path contains a netem. However, filters and actions can cause a packet to change paths when re-enqueued to the root from netem duplication, leading us to the current solution: prevent a duplicating netem from inhabiting the same tree as other netems.
[1] https://lore.kernel.org/netdev/8DuRWwfqjoRDLDmBMlIfbrsZg9Gx50DHJc1ilxsEBNe2D6NMoigReIRIG0LOjMc3r10nUUZtArXx4oZBIdUfZQrwjcQhdinnMis0G7VEk=@willsroot.io/ [2] https://lwn.net/Articles/719297/
[
{
"id": "CVE-2025-38553-06e06f7c",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@250f8796006c0f2bc638ce545f601d49ae8d528b",
"signature_type": "Function",
"target": {
"file": "net/sched/sch_netem.c",
"function": "netem_change"
},
"deprecated": false,
"digest": {
"length": 2438.0,
"function_hash": "325761802817798032406979846663904692674"
},
"signature_version": "v1"
},
{
"id": "CVE-2025-38553-091d18b8",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@09317dfb681ac5a96fc69bea0c54441cf91b8270",
"signature_type": "Line",
"target": {
"file": "net/sched/sch_netem.c"
},
"deprecated": false,
"digest": {
"line_hashes": [
"296970303081078726334047198203727831089",
"160476777962087668971149955709195569978",
"328363763869024282112162152710032576032",
"185156895224730227561634726359131829370",
"190790311011570703900044594776598858259",
"123096748668654868419122779182961050833",
"311640881746052072995562490894609301232"
],
"threshold": 0.9
},
"signature_version": "v1"
},
{
"id": "CVE-2025-38553-1d36547d",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f088b6ebe8797a3f948d2cae47f34bfb45cc6522",
"signature_type": "Line",
"target": {
"file": "net/sched/sch_netem.c"
},
"deprecated": false,
"digest": {
"line_hashes": [
"296970303081078726334047198203727831089",
"160476777962087668971149955709195569978",
"328363763869024282112162152710032576032",
"185156895224730227561634726359131829370",
"190790311011570703900044594776598858259",
"123096748668654868419122779182961050833",
"311640881746052072995562490894609301232"
],
"threshold": 0.9
},
"signature_version": "v1"
},
{
"id": "CVE-2025-38553-2828c651",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ad340a4b4adb855b18b3666f26ad65c8968e2deb",
"signature_type": "Function",
"target": {
"file": "net/sched/sch_netem.c",
"function": "netem_change"
},
"deprecated": false,
"digest": {
"length": 2274.0,
"function_hash": "14581039408756023592575639158314768351"
},
"signature_version": "v1"
},
{
"id": "CVE-2025-38553-43bc6dc2",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cab2809944989889f88a1a8b5cff1c78460c72cb",
"signature_type": "Line",
"target": {
"file": "net/sched/sch_netem.c"
},
"deprecated": false,
"digest": {
"line_hashes": [
"296970303081078726334047198203727831089",
"160476777962087668971149955709195569978",
"328363763869024282112162152710032576032",
"185156895224730227561634726359131829370",
"190790311011570703900044594776598858259",
"123096748668654868419122779182961050833",
"311640881746052072995562490894609301232"
],
"threshold": 0.9
},
"signature_version": "v1"
},
{
"id": "CVE-2025-38553-6bfbc155",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f088b6ebe8797a3f948d2cae47f34bfb45cc6522",
"signature_type": "Function",
"target": {
"file": "net/sched/sch_netem.c",
"function": "netem_change"
},
"deprecated": false,
"digest": {
"length": 2274.0,
"function_hash": "14581039408756023592575639158314768351"
},
"signature_version": "v1"
},
{
"id": "CVE-2025-38553-70377f19",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@795cb393e38977aa991e70a9363da0ee734b2114",
"signature_type": "Function",
"target": {
"file": "net/sched/sch_netem.c",
"function": "netem_change"
},
"deprecated": false,
"digest": {
"length": 2438.0,
"function_hash": "325761802817798032406979846663904692674"
},
"signature_version": "v1"
},
{
"id": "CVE-2025-38553-7b646ef5",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ec8e0e3d7adef940cdf9475e2352c0680189d14e",
"signature_type": "Line",
"target": {
"file": "net/sched/sch_netem.c"
},
"deprecated": false,
"digest": {
"line_hashes": [
"296970303081078726334047198203727831089",
"160476777962087668971149955709195569978",
"328363763869024282112162152710032576032",
"185156895224730227561634726359131829370",
"190790311011570703900044594776598858259",
"123096748668654868419122779182961050833",
"311640881746052072995562490894609301232"
],
"threshold": 0.9
},
"signature_version": "v1"
},
{
"id": "CVE-2025-38553-7cd83fa0",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@103c4e27ec9f5fe53022e46e976abf52c7221baf",
"signature_type": "Line",
"target": {
"file": "net/sched/sch_netem.c"
},
"deprecated": false,
"digest": {
"line_hashes": [
"296970303081078726334047198203727831089",
"160476777962087668971149955709195569978",
"328363763869024282112162152710032576032",
"185156895224730227561634726359131829370",
"190790311011570703900044594776598858259",
"123096748668654868419122779182961050833",
"311640881746052072995562490894609301232"
],
"threshold": 0.9
},
"signature_version": "v1"
},
{
"id": "CVE-2025-38553-84ee258c",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ec8e0e3d7adef940cdf9475e2352c0680189d14e",
"signature_type": "Function",
"target": {
"file": "net/sched/sch_netem.c",
"function": "netem_change"
},
"deprecated": false,
"digest": {
"length": 2438.0,
"function_hash": "325761802817798032406979846663904692674"
},
"signature_version": "v1"
},
{
"id": "CVE-2025-38553-9224691c",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@103c4e27ec9f5fe53022e46e976abf52c7221baf",
"signature_type": "Function",
"target": {
"file": "net/sched/sch_netem.c",
"function": "netem_change"
},
"deprecated": false,
"digest": {
"length": 2438.0,
"function_hash": "325761802817798032406979846663904692674"
},
"signature_version": "v1"
},
{
"id": "CVE-2025-38553-9445e531",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@09317dfb681ac5a96fc69bea0c54441cf91b8270",
"signature_type": "Function",
"target": {
"file": "net/sched/sch_netem.c",
"function": "netem_change"
},
"deprecated": false,
"digest": {
"length": 2438.0,
"function_hash": "325761802817798032406979846663904692674"
},
"signature_version": "v1"
},
{
"id": "CVE-2025-38553-a065b69a",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@250f8796006c0f2bc638ce545f601d49ae8d528b",
"signature_type": "Line",
"target": {
"file": "net/sched/sch_netem.c"
},
"deprecated": false,
"digest": {
"line_hashes": [
"296970303081078726334047198203727831089",
"160476777962087668971149955709195569978",
"328363763869024282112162152710032576032",
"185156895224730227561634726359131829370",
"190790311011570703900044594776598858259",
"123096748668654868419122779182961050833",
"311640881746052072995562490894609301232"
],
"threshold": 0.9
},
"signature_version": "v1"
},
{
"id": "CVE-2025-38553-a9508fe2",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ad340a4b4adb855b18b3666f26ad65c8968e2deb",
"signature_type": "Line",
"target": {
"file": "net/sched/sch_netem.c"
},
"deprecated": false,
"digest": {
"line_hashes": [
"296970303081078726334047198203727831089",
"160476777962087668971149955709195569978",
"328363763869024282112162152710032576032",
"185156895224730227561634726359131829370",
"190790311011570703900044594776598858259",
"123096748668654868419122779182961050833",
"311640881746052072995562490894609301232"
],
"threshold": 0.9
},
"signature_version": "v1"
},
{
"id": "CVE-2025-38553-ba9c7c4d",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@325f5ec67cc0a77f2d0d453445b9857f1cd06c76",
"signature_type": "Function",
"target": {
"file": "net/sched/sch_netem.c",
"function": "netem_change"
},
"deprecated": false,
"digest": {
"length": 2235.0,
"function_hash": "30201075502770401683587093039504508511"
},
"signature_version": "v1"
},
{
"id": "CVE-2025-38553-c3278505",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cab2809944989889f88a1a8b5cff1c78460c72cb",
"signature_type": "Function",
"target": {
"file": "net/sched/sch_netem.c",
"function": "netem_change"
},
"deprecated": false,
"digest": {
"length": 2274.0,
"function_hash": "14581039408756023592575639158314768351"
},
"signature_version": "v1"
},
{
"id": "CVE-2025-38553-e72d92d3",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@325f5ec67cc0a77f2d0d453445b9857f1cd06c76",
"signature_type": "Line",
"target": {
"file": "net/sched/sch_netem.c"
},
"deprecated": false,
"digest": {
"line_hashes": [
"296970303081078726334047198203727831089",
"160476777962087668971149955709195569978",
"328363763869024282112162152710032576032",
"185156895224730227561634726359131829370",
"190790311011570703900044594776598858259",
"123096748668654868419122779182961050833",
"311640881746052072995562490894609301232"
],
"threshold": 0.9
},
"signature_version": "v1"
},
{
"id": "CVE-2025-38553-f21fff55",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@795cb393e38977aa991e70a9363da0ee734b2114",
"signature_type": "Line",
"target": {
"file": "net/sched/sch_netem.c"
},
"deprecated": false,
"digest": {
"line_hashes": [
"296970303081078726334047198203727831089",
"160476777962087668971149955709195569978",
"328363763869024282112162152710032576032",
"185156895224730227561634726359131829370",
"190790311011570703900044594776598858259",
"123096748668654868419122779182961050833",
"311640881746052072995562490894609301232"
],
"threshold": 0.9
},
"signature_version": "v1"
}
]