In the Linux kernel, the following vulnerability has been resolved:
net_sched: skbprio: Remove overly strict queue assertions
In the current implementation, skbprio enqueue/dequeue contains an assertion that fails under certain conditions when SKBPRIO is used as a child qdisc under TBF with specific parameters. The failure occurs because TBF sometimes peeks at packets in the child qdisc without actually dequeuing them when tokens are unavailable.
This peek operation creates a discrepancy between the parent and child qdisc queue length counters. When TBF later receives a high-priority packet, SKBPRIO's queue length may show a different value than what's reflected in its internal priority queue tracking, triggering the assertion.
The fix removes this overly strict assertions in SKBPRIO, they are not necessary at all.
[
{
"id": "CVE-2025-38637-1a15fd3e",
"signature_version": "v1",
"digest": {
"length": 1490.0,
"function_hash": "194532022410922705377098210653153044391"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@864ca690ff135078d374bd565b9872f161c614bc",
"target": {
"file": "net/sched/sch_skbprio.c",
"function": "skbprio_enqueue"
}
},
{
"id": "CVE-2025-38637-22ddaec6",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"2699252214495080082597595576958260950",
"65736125128140615102476641314343381110",
"314146714099404508480195689194950065090",
"19840183765617071294056666509161470763",
"191686863757878210498736442803174813736",
"158750211093160713473374621876653763334",
"289231980406616405293598482830005335115",
"1616137459723356916940782884420876276"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@864ca690ff135078d374bd565b9872f161c614bc",
"target": {
"file": "net/sched/sch_skbprio.c"
}
},
{
"id": "CVE-2025-38637-288654f7",
"signature_version": "v1",
"digest": {
"length": 1503.0,
"function_hash": "269591600902919603140120452997530958677"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2286770b07cb5268c03d11274b8efd43dff0d380",
"target": {
"file": "net/sched/sch_skbprio.c",
"function": "skbprio_enqueue"
}
},
{
"id": "CVE-2025-38637-36b54502",
"signature_version": "v1",
"digest": {
"length": 1503.0,
"function_hash": "269591600902919603140120452997530958677"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ce8fe975fd99b49c29c42e50f2441ba53112b2e8",
"target": {
"file": "net/sched/sch_skbprio.c",
"function": "skbprio_enqueue"
}
},
{
"id": "CVE-2025-38637-3856d6ad",
"signature_version": "v1",
"digest": {
"length": 611.0,
"function_hash": "310512479489532179537370938211924774618"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2f35b7673a3aa3d09b3eb05811669622ebaa98ca",
"target": {
"file": "net/sched/sch_skbprio.c",
"function": "skbprio_dequeue"
}
},
{
"id": "CVE-2025-38637-3f740493",
"signature_version": "v1",
"digest": {
"length": 611.0,
"function_hash": "310512479489532179537370938211924774618"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2286770b07cb5268c03d11274b8efd43dff0d380",
"target": {
"file": "net/sched/sch_skbprio.c",
"function": "skbprio_dequeue"
}
},
{
"id": "CVE-2025-38637-55ac849b",
"signature_version": "v1",
"digest": {
"length": 611.0,
"function_hash": "310512479489532179537370938211924774618"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@864ca690ff135078d374bd565b9872f161c614bc",
"target": {
"file": "net/sched/sch_skbprio.c",
"function": "skbprio_dequeue"
}
},
{
"id": "CVE-2025-38637-60e6d190",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"2699252214495080082597595576958260950",
"65736125128140615102476641314343381110",
"314146714099404508480195689194950065090",
"19840183765617071294056666509161470763",
"191686863757878210498736442803174813736",
"158750211093160713473374621876653763334",
"289231980406616405293598482830005335115",
"1616137459723356916940782884420876276"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@034b293bf17c124fec0f0e663f81203b00aa7a50",
"target": {
"file": "net/sched/sch_skbprio.c"
}
},
{
"id": "CVE-2025-38637-641393e8",
"signature_version": "v1",
"digest": {
"length": 1503.0,
"function_hash": "269591600902919603140120452997530958677"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@034b293bf17c124fec0f0e663f81203b00aa7a50",
"target": {
"file": "net/sched/sch_skbprio.c",
"function": "skbprio_enqueue"
}
},
{
"id": "CVE-2025-38637-7df83fe4",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"2699252214495080082597595576958260950",
"65736125128140615102476641314343381110",
"314146714099404508480195689194950065090",
"19840183765617071294056666509161470763",
"191686863757878210498736442803174813736",
"158750211093160713473374621876653763334",
"289231980406616405293598482830005335115",
"1616137459723356916940782884420876276"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2f35b7673a3aa3d09b3eb05811669622ebaa98ca",
"target": {
"file": "net/sched/sch_skbprio.c"
}
},
{
"id": "CVE-2025-38637-9bec5afc",
"signature_version": "v1",
"digest": {
"length": 611.0,
"function_hash": "310512479489532179537370938211924774618"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ce8fe975fd99b49c29c42e50f2441ba53112b2e8",
"target": {
"file": "net/sched/sch_skbprio.c",
"function": "skbprio_dequeue"
}
},
{
"id": "CVE-2025-38637-af752d7a",
"signature_version": "v1",
"digest": {
"length": 611.0,
"function_hash": "310512479489532179537370938211924774618"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@034b293bf17c124fec0f0e663f81203b00aa7a50",
"target": {
"file": "net/sched/sch_skbprio.c",
"function": "skbprio_dequeue"
}
},
{
"id": "CVE-2025-38637-c2cbac8e",
"signature_version": "v1",
"digest": {
"length": 1503.0,
"function_hash": "269591600902919603140120452997530958677"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2f35b7673a3aa3d09b3eb05811669622ebaa98ca",
"target": {
"file": "net/sched/sch_skbprio.c",
"function": "skbprio_enqueue"
}
},
{
"id": "CVE-2025-38637-c4f9679c",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"2699252214495080082597595576958260950",
"65736125128140615102476641314343381110",
"314146714099404508480195689194950065090",
"19840183765617071294056666509161470763",
"191686863757878210498736442803174813736",
"158750211093160713473374621876653763334",
"289231980406616405293598482830005335115",
"1616137459723356916940782884420876276"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2286770b07cb5268c03d11274b8efd43dff0d380",
"target": {
"file": "net/sched/sch_skbprio.c"
}
},
{
"id": "CVE-2025-38637-e30faa2c",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"2699252214495080082597595576958260950",
"65736125128140615102476641314343381110",
"314146714099404508480195689194950065090",
"19840183765617071294056666509161470763",
"191686863757878210498736442803174813736",
"158750211093160713473374621876653763334",
"289231980406616405293598482830005335115",
"1616137459723356916940782884420876276"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ce8fe975fd99b49c29c42e50f2441ba53112b2e8",
"target": {
"file": "net/sched/sch_skbprio.c"
}
}
]