In the Linux kernel, the following vulnerability has been resolved:
net/sched: schqfq: Fix null-deref in aggdequeue
To prevent a potential crash in aggdequeue (net/sched/schqfq.c) when cl->qdisc->ops->peek(cl->qdisc) returns NULL, we check the return value before using it, similar to the existing approach in sch_hfsc.c.
To avoid code duplication, the following changes are made:
Changed qdiscwarnnonwc(include/net/pkt_sched.h) into a static inline function.
Moved qdiscpeeklen from net/sched/schhfsc.c to include/net/pktsched.h so that sch_qfq can reuse it.
Applied qdiscpeeklen in agg_dequeue to avoid crashing.
[
{
"digest": {
"line_hashes": [
"83381979694204221444222350530570490498",
"29693556062952298380156799145234485194",
"38576434547748978160457114881206215347",
"255744141664514455983902497097592436872",
"152116045419247713974188400100674151966",
"320208808689137863045264028652281851184",
"46671026359635685250481871245641043473",
"208781084902327857834246510953293729821",
"91384389885279474045498103418595861299",
"186229764056871700677236995322958212307",
"319585820247100296822460042644541253453",
"317354012058292570365970868732240103777"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6ffa9d66187188e3068b5a3895e6ae1ee34f9199",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "net/sched/sch_api.c"
},
"id": "CVE-2025-40083-1974b6bd",
"signature_type": "Line"
},
{
"digest": {
"line_hashes": [
"96998056118149877245791553514875847261",
"170266973674008860209285407530874581033",
"305204401602462186323109345936993133183",
"240594802530360647935820842966481159232",
"77823948035253626530174610513073091198",
"132096401416722034797517020541344893120",
"270304633549800452517606511454781661399",
"108422834629078456700496894936708511989",
"203207524291321153862789891223188309221",
"19268620721528102944637227189176028382",
"57716383283488152423039187034867372562",
"245835622001880591857173049567081328684",
"338953619456495364459662762882337410409",
"293014093825296195543735419464225949653",
"2980906193803032941982349483525695724",
"84861727532270517402890502783938551679"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dd831ac8221e691e9e918585b1003c7071df0379",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "net/sched/sch_hfsc.c"
},
"id": "CVE-2025-40083-2d25d3e1",
"signature_type": "Line"
},
{
"digest": {
"line_hashes": [
"122499319634636729026977899398453785775",
"195273254966920875853747338318779788170",
"62943637933939132579049661844432041561",
"273474026677778968975619342477955230564"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6ffa9d66187188e3068b5a3895e6ae1ee34f9199",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "net/sched/sch_qfq.c"
},
"id": "CVE-2025-40083-45de3c88",
"signature_type": "Line"
},
{
"digest": {
"line_hashes": [
"83381979694204221444222350530570490498",
"29693556062952298380156799145234485194",
"38576434547748978160457114881206215347",
"255744141664514455983902497097592436872",
"152116045419247713974188400100674151966",
"320208808689137863045264028652281851184",
"46671026359635685250481871245641043473",
"208781084902327857834246510953293729821",
"91384389885279474045498103418595861299",
"186229764056871700677236995322958212307",
"319585820247100296822460042644541253453",
"317354012058292570365970868732240103777"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dd831ac8221e691e9e918585b1003c7071df0379",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "net/sched/sch_api.c"
},
"id": "CVE-2025-40083-579308da",
"signature_type": "Line"
},
{
"digest": {
"length": 251.0,
"function_hash": "206737715160337834693829025081390462739"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6ff8e74c8f8a68ec07ef837b95425dfe900d060f",
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "qdisc_peek_len",
"file": "net/sched/sch_hfsc.c"
},
"id": "CVE-2025-40083-57f3f96e",
"signature_type": "Function"
},
{
"digest": {
"line_hashes": [
"132441602079178702278396185587913951700",
"196078377192389463546778849885161440722",
"258506010508136110816055757553556238525",
"324230771519111913060890826464461575253",
"58534584230325691977359007243998304911"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6ffa9d66187188e3068b5a3895e6ae1ee34f9199",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "include/net/pkt_sched.h"
},
"id": "CVE-2025-40083-69214cf8",
"signature_type": "Line"
},
{
"digest": {
"line_hashes": [
"96998056118149877245791553514875847261",
"170266973674008860209285407530874581033",
"305204401602462186323109345936993133183",
"240594802530360647935820842966481159232",
"77823948035253626530174610513073091198",
"132096401416722034797517020541344893120",
"270304633549800452517606511454781661399",
"108422834629078456700496894936708511989",
"203207524291321153862789891223188309221",
"19268620721528102944637227189176028382",
"57716383283488152423039187034867372562",
"245835622001880591857173049567081328684",
"338953619456495364459662762882337410409",
"293014093825296195543735419464225949653",
"2980906193803032941982349483525695724",
"84861727532270517402890502783938551679"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6ff8e74c8f8a68ec07ef837b95425dfe900d060f",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "net/sched/sch_hfsc.c"
},
"id": "CVE-2025-40083-6b3e6edf",
"signature_type": "Line"
},
{
"digest": {
"line_hashes": [
"122499319634636729026977899398453785775",
"195273254966920875853747338318779788170",
"62943637933939132579049661844432041561",
"273474026677778968975619342477955230564"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6ff8e74c8f8a68ec07ef837b95425dfe900d060f",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "net/sched/sch_qfq.c"
},
"id": "CVE-2025-40083-75954b82",
"signature_type": "Line"
},
{
"digest": {
"line_hashes": [
"83381979694204221444222350530570490498",
"29693556062952298380156799145234485194",
"38576434547748978160457114881206215347",
"255744141664514455983902497097592436872",
"152116045419247713974188400100674151966",
"320208808689137863045264028652281851184",
"46671026359635685250481871245641043473",
"208781084902327857834246510953293729821",
"91384389885279474045498103418595861299",
"186229764056871700677236995322958212307",
"319585820247100296822460042644541253453",
"317354012058292570365970868732240103777"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6ff8e74c8f8a68ec07ef837b95425dfe900d060f",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "net/sched/sch_api.c"
},
"id": "CVE-2025-40083-787aa773",
"signature_type": "Line"
},
{
"digest": {
"length": 259.0,
"function_hash": "181464991163416648277716845933739187018"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6ffa9d66187188e3068b5a3895e6ae1ee34f9199",
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "qdisc_warn_nonwc",
"file": "net/sched/sch_api.c"
},
"id": "CVE-2025-40083-91069b89",
"signature_type": "Function"
},
{
"digest": {
"length": 462.0,
"function_hash": "70226324765963935944452573569979818391"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dd831ac8221e691e9e918585b1003c7071df0379",
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "agg_dequeue",
"file": "net/sched/sch_qfq.c"
},
"id": "CVE-2025-40083-a812ff73",
"signature_type": "Function"
},
{
"digest": {
"length": 251.0,
"function_hash": "206737715160337834693829025081390462739"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dd831ac8221e691e9e918585b1003c7071df0379",
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "qdisc_peek_len",
"file": "net/sched/sch_hfsc.c"
},
"id": "CVE-2025-40083-aa5a8437",
"signature_type": "Function"
},
{
"digest": {
"line_hashes": [
"132441602079178702278396185587913951700",
"196078377192389463546778849885161440722",
"258506010508136110816055757553556238525",
"324230771519111913060890826464461575253",
"58534584230325691977359007243998304911"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6ff8e74c8f8a68ec07ef837b95425dfe900d060f",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "include/net/pkt_sched.h"
},
"id": "CVE-2025-40083-bbfc0a01",
"signature_type": "Line"
},
{
"digest": {
"length": 259.0,
"function_hash": "181464991163416648277716845933739187018"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6ff8e74c8f8a68ec07ef837b95425dfe900d060f",
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "qdisc_warn_nonwc",
"file": "net/sched/sch_api.c"
},
"id": "CVE-2025-40083-c44a2caf",
"signature_type": "Function"
},
{
"digest": {
"length": 462.0,
"function_hash": "70226324765963935944452573569979818391"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6ffa9d66187188e3068b5a3895e6ae1ee34f9199",
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "agg_dequeue",
"file": "net/sched/sch_qfq.c"
},
"id": "CVE-2025-40083-c52f78a0",
"signature_type": "Function"
},
{
"digest": {
"line_hashes": [
"96998056118149877245791553514875847261",
"170266973674008860209285407530874581033",
"305204401602462186323109345936993133183",
"240594802530360647935820842966481159232",
"77823948035253626530174610513073091198",
"132096401416722034797517020541344893120",
"270304633549800452517606511454781661399",
"108422834629078456700496894936708511989",
"203207524291321153862789891223188309221",
"19268620721528102944637227189176028382",
"57716383283488152423039187034867372562",
"245835622001880591857173049567081328684",
"338953619456495364459662762882337410409",
"293014093825296195543735419464225949653",
"2980906193803032941982349483525695724",
"84861727532270517402890502783938551679"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6ffa9d66187188e3068b5a3895e6ae1ee34f9199",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "net/sched/sch_hfsc.c"
},
"id": "CVE-2025-40083-c6795093",
"signature_type": "Line"
},
{
"digest": {
"line_hashes": [
"132441602079178702278396185587913951700",
"196078377192389463546778849885161440722",
"258506010508136110816055757553556238525",
"324230771519111913060890826464461575253",
"58534584230325691977359007243998304911"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dd831ac8221e691e9e918585b1003c7071df0379",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "include/net/pkt_sched.h"
},
"id": "CVE-2025-40083-dad0a496",
"signature_type": "Line"
},
{
"digest": {
"line_hashes": [
"122499319634636729026977899398453785775",
"195273254966920875853747338318779788170",
"62943637933939132579049661844432041561",
"273474026677778968975619342477955230564"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dd831ac8221e691e9e918585b1003c7071df0379",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "net/sched/sch_qfq.c"
},
"id": "CVE-2025-40083-e1c49675",
"signature_type": "Line"
},
{
"digest": {
"length": 251.0,
"function_hash": "206737715160337834693829025081390462739"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6ffa9d66187188e3068b5a3895e6ae1ee34f9199",
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "qdisc_peek_len",
"file": "net/sched/sch_hfsc.c"
},
"id": "CVE-2025-40083-e40693cd",
"signature_type": "Function"
},
{
"digest": {
"length": 462.0,
"function_hash": "70226324765963935944452573569979818391"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6ff8e74c8f8a68ec07ef837b95425dfe900d060f",
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "agg_dequeue",
"file": "net/sched/sch_qfq.c"
},
"id": "CVE-2025-40083-e8e7c486",
"signature_type": "Function"
},
{
"digest": {
"length": 259.0,
"function_hash": "181464991163416648277716845933739187018"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dd831ac8221e691e9e918585b1003c7071df0379",
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "qdisc_warn_nonwc",
"file": "net/sched/sch_api.c"
},
"id": "CVE-2025-40083-ff06f7d9",
"signature_type": "Function"
}
]