CVE-2025-68325

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-68325
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-68325.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-68325
Downstream
BELL (1)
CLSA (1)
DEBIAN (1)
ECHO (1)
openSUSE (3)
ROOT (5)
SUSE (11)
UBUNTU (1)
Related
openSUSE (3)
SUSE (11)
Published
2025-12-18T15:02:50Z
Modified
2026-10-15T02:30:31Z
Summary
net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop
Details

In the Linux kernel, the following vulnerability has been resolved:

net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop

In cake_drop(), qdisc_tree_reduce_backlog() is used to update the qlen and backlog of the qdisc hierarchy. Its caller, cake_enqueue(), assumes that the parent qdisc will enqueue the current packet. However, this assumption breaks when cake_enqueue() returns NET_XMIT_CN: the parent qdisc stops enqueuing current packet, leaving the tree qlen/backlog accounting inconsistent. This mismatch can lead to a NULL dereference (e.g., when the parent Qdisc is qfq_qdisc).

This patch computes the qlen/backlog delta in a more robust way by observing the difference before and after the series of cake_drop() calls, and then compensates the qdisc tree accounting if cake_enqueue() returns NET_XMIT_CN.

To ensure correct compensation when ACK thinning is enabled, a new variable is introduced to keep qlen unchanged.

Database specific 
{
    "cna_assigner":  "Linux",
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68325.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
de04ddd2980b48caa8d7e24a7db2742917a8b280
Fixed
a3f4e3de41a3f115db35276c6b186ccbc913934a
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
0dacfc5372e314d1219f03e64dde3ab495a5a25e
Fixed
38abf6e931b169ea88d7529b49096f53a5dcf8fe
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
710866fc0a64eafcb8bacd91bcb1329eb7e5035f
Fixed
fcb91be52eb6e92e00b533ebd7c77fecada537e1
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
aa12ee1c1bd260943fd6ab556d8635811c332eeb
Fixed
d01f0e072dadb02fe10f436b940dd957aff0d7d4
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
ff57186b2cc39766672c4c0332323933e5faaa88
Fixed
0b6216f9b3d1c33c76f74511026e5de5385ee520
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
15de71d06a400f7fdc15bf377a2552b0ec437cf5
Fixed
529c284cc2815c8350860e9a31722050fe7117cb
Fixed
3ed6c458530a547ed0c9ea0b02b19bab620be88b
Fixed
9fefc78f7f02d71810776fdeb119a05a946a27cc
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
5.10.241
Fixed
5.10.248
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
5.15.190
Fixed
5.15.198
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
6.1.149
Fixed
6.1.160
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
6.6.103
Fixed
6.6.120
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
6.12.44
Fixed
6.12.63
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
5.4.297
Fixed
5.5
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
6.16.4
Fixed
6.17
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
7689ab22de36f8db19095f6bdf11f28cfde92f5c
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
62d591dde4defb1333d202410609c4ddeae060b3

Affected versions

v5.*
v5.10.241
v5.10.242
v5.10.243
v5.10.244
v5.10.245
v5.10.246
v5.10.247
v5.15.190
v5.15.191
v5.15.192
v5.15.193
v5.15.194
v5.15.195
v5.15.196
v5.15.197
v5.4.297
v5.4.298
v5.4.299
v5.4.300
v5.4.301
v5.4.302
v6.*
v6.1.149
v6.1.150
v6.1.151
v6.1.152
v6.1.153
v6.1.154
v6.1.155
v6.1.156
v6.1.157
v6.1.158
v6.1.159
v6.12.44
v6.12.45
v6.12.46
v6.12.47
v6.12.48
v6.12.49
v6.12.50
v6.12.51
v6.12.52
v6.12.53
v6.12.54
v6.12.55
v6.12.56
v6.12.57
v6.12.58
v6.12.59
v6.12.60
v6.12.61
v6.12.62
v6.16.10
v6.16.11
v6.16.12
v6.16.4
v6.16.5
v6.16.6
v6.16.7
v6.16.8
v6.16.9
v6.6.103
v6.6.104
v6.6.105
v6.6.106
v6.6.107
v6.6.108
v6.6.109
v6.6.110
v6.6.111
v6.6.112
v6.6.113
v6.6.114
v6.6.115
v6.6.116
v6.6.117
v6.6.118
v6.6.119

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-68325.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
5.10.248
Type
ECOSYSTEM
Events
Introduced
5.11.0
Fixed
5.15.198
Type
ECOSYSTEM
Events
Introduced
5.16.0
Fixed
6.1.160
Type
ECOSYSTEM
Events
Introduced
6.2.0
Fixed
6.6.120
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.12.63
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.17.13
Type
ECOSYSTEM
Events
Introduced
6.17.0
Fixed
6.18.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-68325.json"