Skip to content
Heist/ feed
High

net/sched: ets: Remove drr class from the active list if it changes to strict

Type: advisorySource: Official CVE List1 source record

In the Linux kernel, the following vulnerability has been resolved: net/sched: ets: Remove drr class from the active list if it changes to strict Whenever a user issues an ets qdisc change command, transforming a drr class into a strict one, the ets code isn't checking whether that class was in the active list and removing it. This means that, if a user changes a strict class (which was in the active list) back to a drr one, that class will be added twice to the active list [1]. Doing so with the following commands: tc qdisc add dev lo root handle 1: ets bands 2 strict 1 tc qdisc add dev lo parent 1:2 handle 20: \ tbf rate 8bit burst 100b latency 1s tc filter add dev lo parent 1: basic classid 1:2 ping -c1 -W0.01 -s 56 127.0.0.1 tc qdisc change dev lo root handle 1: ets bands 2 strict 2 tc qdisc change dev lo root handle 1: ets bands 2 strict 1 ping -c1 -W0.01 -s 56 127.0.0.1 Will trigger the following splat with list debug turned on: [ 59.279014][ T365] ------------[ cut here ]------------ [ 59.279452][ T365] list_add double add: new=ffff88801d60e350, prev=ffff88801d60e350, next=ffff88801d60e2c0. [ 59.280153][ T365] WARNING: CPU: 3 PID: 365 at lib/list_debug.c:35 __list_add_valid_or_report+0x17f/0x220 [ 59.280860][ T365] Modules linked in: [ 59.281165][ T365] CPU: 3 UID: 0 PID: 365 Comm: tc Not tainted 6.18.0-rc7-00105-g7e9f13163c13-dirty #239 PREEMPT(voluntary) [ 59.281977][ T365] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 59.282391][ T365] RIP: 0010:__list_add_val

Announced Source revision 1
Original source ↗

CVE-2025-68815

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2025-68815

Linux

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Linux

Source reference: /containers/cna/affected/1/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "f517335a61ff8037b18ba1b0a002c1f82926a934",
        "lessThan": "58fdce6bc005e964f1dbc3ca716f5fe0f68839a2",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "cd9b50adc6bb9ad3f7d244590a389522215865c4",
        "lessThan": "02783a37cb1c0a2bd9fcba4ff1b81e6e209c7d87",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "cd9b50adc6bb9ad3f7d244590a389522215865c4",
        "lessThan": "8067db5c95aab9461d23117679338cd8869831fa",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "cd9b50adc6bb9ad3f7d244590a389522215865c4",
        "lessThan": "2f125ebe47d6369e562f3cbd9b6227cff51eaf34",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "cd9b50adc6bb9ad3f7d244590a389522215865c4",
        "lessThan": "cca2ed931b734fe48139bc6f020e47367346630f",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "cd9b50adc6bb9ad3f7d244590a389522215865c4",
        "lessThan": "43d9a530c8c094d137159784e7c951c65f11ec6c",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "cd9b50adc6bb9ad3f7d244590a389522215865c4",
        "lessThan": "b1e125ae425aba9b45252e933ca8df52a843ec70",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "d05330672afe2e142ba97e63bd7c1faef76781bb",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "5.10.62",
        "lessThan": "5.10.248",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "5.13.14",
        "lessThan": "5.14",
        "versionType": "semver"
      }
    ],
    "programFiles": [
      "net/sched/sch_ets.c"
    ],
    "defaultStatus": "unaffected"
  },
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "5.14"
      },
      {
        "status": "unaffected",
        "version": "0",
        "lessThan": "5.14",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "5.10.248",
        "versionType": "semver",
        "lessThanOrEqual": "5.10.*"
      },
      {
        "status": "unaffected",
        "version": "5.15.198",
        "versionType": "semver",
        "lessThanOrEqual": "5.15.*"
      },
      {
        "status": "unaffected",
        "version": "6.1.160",
        "versionType": "semver",
        "lessThanOrEqual": "6.1.*"
      },
      {
        "status": "unaffected",
        "version": "6.6.120",
        "versionType": "semver",
        "lessThanOrEqual": "6.6.*"
      },
      {
        "status": "unaffected",
        "version": "6.12.64",
        "versionType": "semver",
        "lessThanOrEqual": "6.12.*"
      },
      {
        "status": "unaffected",
        "version": "6.18.3",
        "versionType": "semver",
        "lessThanOrEqual": "6.18.*"
      },
      {
        "status": "unaffected",
        "version": "6.19",
        "versionType": "original_commit_for_fix",
        "lessThanOrEqual": "*"
      }
    ],
    "programFiles": [
      "net/sched/sch_ets.c"
    ],
    "defaultStatus": "affected"
  }
]
Related CVEs
CVE-2025-68815

Source reference: /cveMetadata/cveId

Publisher severity

high

Source reference: /containers/cna/metrics

Event
#39131 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement