https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 22:29:55 +0000 https://vulnerability.circl.lu/vuln/cve-2025-38000 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue()</p> <p>When enqueuing the first packet to an HFSC class, hfsc_enqueue() calls the child qdisc&#39;s peek() operation before incrementing sch-&gt;q.qlen and sch-&gt;qstats.backlog. If the child qdisc uses qdisc_peek_dequeued(), this may trigger an immediate dequeue and potential packet drop. In such cases, qdisc_tree_reduce_backlog() is called, but the HFSC qdisc&#39;s qlen and backlog have not yet been updated, leading to inconsistent queue accounting. This can leave an empty HFSC class in the active list, causing further consequences like use-after-free.</p> <p>This patch fixes the bug by moving the increment of sch-&gt;q.qlen and sch-&gt;qstats.backlog before the call to the child qdisc&#39;s peek() operation. This ensures that queue length and backlog are always accurate when packet drops or dequeues are triggered during the peek.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue()</p> <p>When enqueuing the first packet to an HFSC class, hfsc_enqueue() calls the child qdisc&#39;s peek() operation before incrementing sch-&gt;q.qlen and sch-&gt;qstats.backlog. If the child qdisc uses qdisc_peek_dequeued(), this may trigger an immediate dequeue and potential packet drop. In such cases, qdisc_tree_reduce_backlog() is called, but the HFSC qdisc&#39;s qlen and backlog have not yet been updated, leading to inconsistent queue accounting. This can leave an empty HFSC class in the active list, causing further consequences like use-after-free.</p> <p>This patch fixes the bug by moving the increment of sch-&gt;q.qlen and sch-&gt;qstats.backlog before the call to the child qdisc&#39;s peek() operation. This ensures that queue length and backlog are always accurate when packet drops or dequeues are triggered during the peek.</p> https://vulnerability.circl.lu/vuln/cve-2025-38000