In the Linux kernel, the following vulnerability has been resolved:
page_pool: avoid infinite loop to schedule delayed worker
We noticed the kworker in pagepoolreleaseretry() was waken up repeatedly and infinitely in production because of the buggy driver causing the inflight less than 0 and warning us in pagepool_inflight()[1].
Since the inflight value goes negative, it means we should not expect the whole page_pool to get back to work normally.
This patch mitigates the adverse effect by not rescheduling the kworker when detecting the inflight negative in pagepoolrelease_retry().
[1] [Mon Feb 10 20:36:11 2025] ------------[ cut here ]------------ [Mon Feb 10 20:36:11 2025] Negative(-51446) inflight packet-pages ... [Mon Feb 10 20:36:11 2025] Call Trace: [Mon Feb 10 20:36:11 2025] pagepoolreleaseretry+0x23/0x70 [Mon Feb 10 20:36:11 2025] processonework+0x1b1/0x370 [Mon Feb 10 20:36:11 2025] workerthread+0x37/0x3a0 [Mon Feb 10 20:36:11 2025] kthread+0x11a/0x140 [Mon Feb 10 20:36:11 2025] ? processonework+0x370/0x370 [Mon Feb 10 20:36:11 2025] ? _kthreadcancelwork+0x40/0x40 [Mon Feb 10 20:36:11 2025] retfromfork+0x35/0x40 [Mon Feb 10 20:36:11 2025] ---[ end trace ebffe800f33e7e34 ]--- Note: before this patch, the above calltrace would flood the dmesg due to repeated reschedule of releasedw kworker.
[
    {
        "signature_version": "v1",
        "id": "CVE-2025-37859-074ac7d1",
        "signature_type": "Function",
        "digest": {
            "length": 526.0,
            "function_hash": "312097122513849914647939328495165674965"
        },
        "target": {
            "file": "net/core/page_pool.c",
            "function": "page_pool_release_retry"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9f71db4fb82deb889e0bac4a51b34daea7d506a3",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "id": "CVE-2025-37859-10e1f73c",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "288567616484457987885050087675203013361",
                "156520597017858793642681204316139602254",
                "209223154738997026760523880295546283634",
                "123765858860502207485474193633076536824"
            ]
        },
        "target": {
            "file": "net/core/page_pool.c"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@738d1812ec2e395e953258aea912ddd867d11a13",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "id": "CVE-2025-37859-10f381b1",
        "signature_type": "Function",
        "digest": {
            "length": 526.0,
            "function_hash": "312097122513849914647939328495165674965"
        },
        "target": {
            "file": "net/core/page_pool.c",
            "function": "page_pool_release_retry"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@91522aba56e9fcdf64da25ffef9b27f8fad48e0f",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "id": "CVE-2025-37859-114fad66",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "288567616484457987885050087675203013361",
                "156520597017858793642681204316139602254",
                "209223154738997026760523880295546283634",
                "123765858860502207485474193633076536824"
            ]
        },
        "target": {
            "file": "net/core/page_pool.c"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7204335d1991c23fc615ab76f31f175748a578e1",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "id": "CVE-2025-37859-3989e657",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "159132603483161672900587080522773077237",
                "156520597017858793642681204316139602254",
                "157558674196791741200738169694022837792",
                "158501576026418774800675398755643099858"
            ]
        },
        "target": {
            "file": "net/core/page_pool.c"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c3c7c57017ce1d4b2d3788c1fc59e7e39026e158",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "id": "CVE-2025-37859-4f437a04",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "159132603483161672900587080522773077237",
                "156520597017858793642681204316139602254",
                "157558674196791741200738169694022837792",
                "158501576026418774800675398755643099858"
            ]
        },
        "target": {
            "file": "net/core/page_pool.c"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@91522aba56e9fcdf64da25ffef9b27f8fad48e0f",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "id": "CVE-2025-37859-558dc352",
        "signature_type": "Function",
        "digest": {
            "length": 526.0,
            "function_hash": "312097122513849914647939328495165674965"
        },
        "target": {
            "file": "net/core/page_pool.c",
            "function": "page_pool_release_retry"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@95f17738b86fd198924d874a5639bcdc49c7e5b8",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "id": "CVE-2025-37859-63314c9d",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "159132603483161672900587080522773077237",
                "156520597017858793642681204316139602254",
                "157558674196791741200738169694022837792",
                "158501576026418774800675398755643099858"
            ]
        },
        "target": {
            "file": "net/core/page_pool.c"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@90e089a64504982f8d62f223027cb9f903781f78",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "id": "CVE-2025-37859-78b0f9eb",
        "signature_type": "Function",
        "digest": {
            "length": 526.0,
            "function_hash": "312097122513849914647939328495165674965"
        },
        "target": {
            "file": "net/core/page_pool.c",
            "function": "page_pool_release_retry"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@90e089a64504982f8d62f223027cb9f903781f78",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "id": "CVE-2025-37859-7af6797e",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "159132603483161672900587080522773077237",
                "156520597017858793642681204316139602254",
                "157558674196791741200738169694022837792",
                "158501576026418774800675398755643099858"
            ]
        },
        "target": {
            "file": "net/core/page_pool.c"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@95f17738b86fd198924d874a5639bcdc49c7e5b8",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "id": "CVE-2025-37859-8e80b770",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "159132603483161672900587080522773077237",
                "156520597017858793642681204316139602254",
                "157558674196791741200738169694022837792",
                "158501576026418774800675398755643099858"
            ]
        },
        "target": {
            "file": "net/core/page_pool.c"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9f71db4fb82deb889e0bac4a51b34daea7d506a3",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "id": "CVE-2025-37859-94413690",
        "signature_type": "Function",
        "digest": {
            "length": 526.0,
            "function_hash": "312097122513849914647939328495165674965"
        },
        "target": {
            "file": "net/core/page_pool.c",
            "function": "page_pool_release_retry"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c3c7c57017ce1d4b2d3788c1fc59e7e39026e158",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "id": "CVE-2025-37859-aa753487",
        "signature_type": "Function",
        "digest": {
            "length": 644.0,
            "function_hash": "180322522716714665123024233100436993974"
        },
        "target": {
            "file": "net/core/page_pool.c",
            "function": "page_pool_release_retry"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@43130d02baa137033c25297aaae95fd0edc41654",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "id": "CVE-2025-37859-b45e1434",
        "signature_type": "Function",
        "digest": {
            "length": 644.0,
            "function_hash": "180322522716714665123024233100436993974"
        },
        "target": {
            "file": "net/core/page_pool.c",
            "function": "page_pool_release_retry"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e74e5aa33228c5e2cb4fc80ad103541a7b7805ec",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "id": "CVE-2025-37859-c1096f45",
        "signature_type": "Function",
        "digest": {
            "length": 644.0,
            "function_hash": "180322522716714665123024233100436993974"
        },
        "target": {
            "file": "net/core/page_pool.c",
            "function": "page_pool_release_retry"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@738d1812ec2e395e953258aea912ddd867d11a13",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "id": "CVE-2025-37859-c2c66847",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "288567616484457987885050087675203013361",
                "156520597017858793642681204316139602254",
                "209223154738997026760523880295546283634",
                "123765858860502207485474193633076536824"
            ]
        },
        "target": {
            "file": "net/core/page_pool.c"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@43130d02baa137033c25297aaae95fd0edc41654",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "id": "CVE-2025-37859-db2fa934",
        "signature_type": "Function",
        "digest": {
            "length": 644.0,
            "function_hash": "180322522716714665123024233100436993974"
        },
        "target": {
            "file": "net/core/page_pool.c",
            "function": "page_pool_release_retry"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7204335d1991c23fc615ab76f31f175748a578e1",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "id": "CVE-2025-37859-e2401a3e",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "288567616484457987885050087675203013361",
                "156520597017858793642681204316139602254",
                "209223154738997026760523880295546283634",
                "123765858860502207485474193633076536824"
            ]
        },
        "target": {
            "file": "net/core/page_pool.c"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e74e5aa33228c5e2cb4fc80ad103541a7b7805ec",
        "deprecated": false
    }
]