In the Linux kernel, the following vulnerability has been resolved:
net/sched: Make cakeenqueue return NETXMITCN when past bufferlimit
The following setup can trigger a WARNING in htb_activate due to the condition: !cl->leaf.q->q.qlen
tc qdisc del dev lo root tc qdisc add dev lo root handle 1: htb default 1 tc class add dev lo parent 1: classid 1:1 \ htb rate 64bit tc qdisc add dev lo parent 1:1 handle f: \ cake memlimit 1b ping -I lo -f -c1 -s64 -W0.001 127.0.0.1
This is because the low memlimit leads to a low bufferlimit, which causes packet dropping. However, cakeenqueue still returns NETXMITSUCCESS, causing htbenqueue to call htbactivate with an empty child qdisc. We should return NETXMITCN when packets are dropped from the same tin and flow.
I do not believe return value of NETXMITCN is necessary for packet drops in the case of ack filtering, as that is meant to optimize performance, not to signal congestion.
[
{
"id": "CVE-2025-39766-143d3304",
"target": {
"function": "cake_enqueue",
"file": "net/sched/sch_cake.c"
},
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 4616.0,
"function_hash": "273349560437776569690735213418033513074"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@62d591dde4defb1333d202410609c4ddeae060b3",
"deprecated": false
},
{
"id": "CVE-2025-39766-1cf1ad14",
"target": {
"file": "net/sched/sch_cake.c"
},
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"line_hashes": [
"148561269783281833202608802636851667581",
"286706768171847264287508106997195016741",
"168733700122332631735574183241600346424",
"306486424718998687034397471159169000562",
"296543034684189587363288659892530759271",
"2900247491164883674834641470454472358",
"12518797470931572507797149142718595379",
"57734454781404163002182770828901783731",
"60212163734830192371383268587084309156",
"294871080810424150531447417709223852428",
"211589055721903569041399360046600805301",
"199473220392079349902456791840371495249",
"329082421563837758559659636949511732881",
"205191847459911531100173971092611423298",
"310200345348364701717167254168915269088",
"3418678134096477137747633474135846819",
"194665048594560893729601582465190874363",
"120915351008910373348198175666693770885"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@710866fc0a64eafcb8bacd91bcb1329eb7e5035f",
"deprecated": false
},
{
"id": "CVE-2025-39766-25067f4d",
"target": {
"file": "net/sched/sch_cake.c"
},
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"line_hashes": [
"148561269783281833202608802636851667581",
"286706768171847264287508106997195016741",
"168733700122332631735574183241600346424",
"306486424718998687034397471159169000562",
"296543034684189587363288659892530759271",
"2900247491164883674834641470454472358",
"12518797470931572507797149142718595379",
"57734454781404163002182770828901783731",
"60212163734830192371383268587084309156",
"294871080810424150531447417709223852428",
"211589055721903569041399360046600805301",
"199473220392079349902456791840371495249",
"329082421563837758559659636949511732881",
"205191847459911531100173971092611423298",
"310200345348364701717167254168915269088",
"3418678134096477137747633474135846819",
"194665048594560893729601582465190874363",
"120915351008910373348198175666693770885"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@62d591dde4defb1333d202410609c4ddeae060b3",
"deprecated": false
},
{
"id": "CVE-2025-39766-3c6ca7a6",
"target": {
"function": "cake_enqueue",
"file": "net/sched/sch_cake.c"
},
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 4616.0,
"function_hash": "273349560437776569690735213418033513074"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@15de71d06a400f7fdc15bf377a2552b0ec437cf5",
"deprecated": false
},
{
"id": "CVE-2025-39766-4191b00e",
"target": {
"function": "cake_enqueue",
"file": "net/sched/sch_cake.c"
},
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 4616.0,
"function_hash": "273349560437776569690735213418033513074"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ff57186b2cc39766672c4c0332323933e5faaa88",
"deprecated": false
},
{
"id": "CVE-2025-39766-41b18402",
"target": {
"function": "cake_enqueue",
"file": "net/sched/sch_cake.c"
},
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 4616.0,
"function_hash": "273349560437776569690735213418033513074"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@710866fc0a64eafcb8bacd91bcb1329eb7e5035f",
"deprecated": false
},
{
"id": "CVE-2025-39766-52b8981a",
"target": {
"file": "net/sched/sch_cake.c"
},
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"line_hashes": [
"148561269783281833202608802636851667581",
"286706768171847264287508106997195016741",
"168733700122332631735574183241600346424",
"306486424718998687034397471159169000562",
"296543034684189587363288659892530759271",
"2900247491164883674834641470454472358",
"12518797470931572507797149142718595379",
"57734454781404163002182770828901783731",
"60212163734830192371383268587084309156",
"294871080810424150531447417709223852428",
"211589055721903569041399360046600805301",
"199473220392079349902456791840371495249",
"329082421563837758559659636949511732881",
"205191847459911531100173971092611423298",
"310200345348364701717167254168915269088",
"3418678134096477137747633474135846819",
"194665048594560893729601582465190874363",
"120915351008910373348198175666693770885"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ff57186b2cc39766672c4c0332323933e5faaa88",
"deprecated": false
},
{
"id": "CVE-2025-39766-588dc6bf",
"target": {
"file": "net/sched/sch_cake.c"
},
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"line_hashes": [
"148561269783281833202608802636851667581",
"286706768171847264287508106997195016741",
"168733700122332631735574183241600346424",
"306486424718998687034397471159169000562",
"296543034684189587363288659892530759271",
"2900247491164883674834641470454472358",
"12518797470931572507797149142718595379",
"57734454781404163002182770828901783731",
"60212163734830192371383268587084309156",
"294871080810424150531447417709223852428",
"211589055721903569041399360046600805301",
"199473220392079349902456791840371495249",
"329082421563837758559659636949511732881",
"205191847459911531100173971092611423298",
"310200345348364701717167254168915269088",
"3418678134096477137747633474135846819",
"194665048594560893729601582465190874363",
"120915351008910373348198175666693770885"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@aa12ee1c1bd260943fd6ab556d8635811c332eeb",
"deprecated": false
},
{
"id": "CVE-2025-39766-64ff907c",
"target": {
"function": "cake_enqueue",
"file": "net/sched/sch_cake.c"
},
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 4616.0,
"function_hash": "273349560437776569690735213418033513074"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@aa12ee1c1bd260943fd6ab556d8635811c332eeb",
"deprecated": false
},
{
"id": "CVE-2025-39766-6bd9b4c2",
"target": {
"function": "cake_enqueue",
"file": "net/sched/sch_cake.c"
},
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 4616.0,
"function_hash": "273349560437776569690735213418033513074"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0dacfc5372e314d1219f03e64dde3ab495a5a25e",
"deprecated": false
},
{
"id": "CVE-2025-39766-7ef80187",
"target": {
"function": "cake_enqueue",
"file": "net/sched/sch_cake.c"
},
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 4616.0,
"function_hash": "273349560437776569690735213418033513074"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@de04ddd2980b48caa8d7e24a7db2742917a8b280",
"deprecated": false
},
{
"id": "CVE-2025-39766-84017fbd",
"target": {
"file": "net/sched/sch_cake.c"
},
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"line_hashes": [
"148561269783281833202608802636851667581",
"286706768171847264287508106997195016741",
"168733700122332631735574183241600346424",
"306486424718998687034397471159169000562",
"296543034684189587363288659892530759271",
"2900247491164883674834641470454472358",
"12518797470931572507797149142718595379",
"57734454781404163002182770828901783731",
"60212163734830192371383268587084309156",
"294871080810424150531447417709223852428",
"211589055721903569041399360046600805301",
"199473220392079349902456791840371495249",
"329082421563837758559659636949511732881",
"205191847459911531100173971092611423298",
"310200345348364701717167254168915269088",
"3418678134096477137747633474135846819",
"194665048594560893729601582465190874363",
"120915351008910373348198175666693770885"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@15de71d06a400f7fdc15bf377a2552b0ec437cf5",
"deprecated": false
},
{
"id": "CVE-2025-39766-9b3f1658",
"target": {
"file": "net/sched/sch_cake.c"
},
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"line_hashes": [
"148561269783281833202608802636851667581",
"286706768171847264287508106997195016741",
"168733700122332631735574183241600346424",
"306486424718998687034397471159169000562",
"296543034684189587363288659892530759271",
"2900247491164883674834641470454472358",
"12518797470931572507797149142718595379",
"57734454781404163002182770828901783731",
"60212163734830192371383268587084309156",
"294871080810424150531447417709223852428",
"211589055721903569041399360046600805301",
"199473220392079349902456791840371495249",
"329082421563837758559659636949511732881",
"205191847459911531100173971092611423298",
"310200345348364701717167254168915269088",
"3418678134096477137747633474135846819",
"194665048594560893729601582465190874363",
"120915351008910373348198175666693770885"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0dacfc5372e314d1219f03e64dde3ab495a5a25e",
"deprecated": false
},
{
"id": "CVE-2025-39766-9d2c7302",
"target": {
"file": "net/sched/sch_cake.c"
},
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"line_hashes": [
"148561269783281833202608802636851667581",
"286706768171847264287508106997195016741",
"168733700122332631735574183241600346424",
"306486424718998687034397471159169000562",
"296543034684189587363288659892530759271",
"2900247491164883674834641470454472358",
"12518797470931572507797149142718595379",
"57734454781404163002182770828901783731",
"60212163734830192371383268587084309156",
"294871080810424150531447417709223852428",
"211589055721903569041399360046600805301",
"199473220392079349902456791840371495249",
"329082421563837758559659636949511732881",
"205191847459911531100173971092611423298",
"310200345348364701717167254168915269088",
"3418678134096477137747633474135846819",
"194665048594560893729601582465190874363",
"120915351008910373348198175666693770885"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@de04ddd2980b48caa8d7e24a7db2742917a8b280",
"deprecated": false
},
{
"id": "CVE-2025-39766-ad3f9675",
"target": {
"function": "cake_enqueue",
"file": "net/sched/sch_cake.c"
},
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 4622.0,
"function_hash": "97723412412048011913860897306133479818"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7689ab22de36f8db19095f6bdf11f28cfde92f5c",
"deprecated": false
},
{
"id": "CVE-2025-39766-ba268da3",
"target": {
"file": "net/sched/sch_cake.c"
},
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"line_hashes": [
"148561269783281833202608802636851667581",
"286706768171847264287508106997195016741",
"168733700122332631735574183241600346424",
"306486424718998687034397471159169000562",
"296543034684189587363288659892530759271",
"2900247491164883674834641470454472358",
"12518797470931572507797149142718595379",
"57734454781404163002182770828901783731",
"60212163734830192371383268587084309156",
"294871080810424150531447417709223852428",
"211589055721903569041399360046600805301",
"199473220392079349902456791840371495249",
"329082421563837758559659636949511732881",
"205191847459911531100173971092611423298",
"310200345348364701717167254168915269088",
"3418678134096477137747633474135846819",
"194665048594560893729601582465190874363",
"120915351008910373348198175666693770885"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7689ab22de36f8db19095f6bdf11f28cfde92f5c",
"deprecated": false
}
]