Executive brief
A vulnerability in the Linux kernel's networking subsystem could allow a local user to crash the system. The issue occurs within the Enhanced Transmission Selection (ETS) scheduler, which manages how network traffic is prioritized. By triggering specific changes to network queue configurations, an attacker can cause a system-wide crash (kernel panic), leading to a denial of service.
Technical details
A NULL pointer dereference exists in net/sched/sch_ets.c within the ets_qdisc_change() function. The vulnerability is caused by an inconsistent state where the 'nbands' value is updated to a new value before unused DWRR (Deficit Weighted Round Robin) queues are purged. Because functions like ets_class_find() and ets_class_is_strict() rely on the original band configuration during the cleanup process, the premature update leads to invalid memory access. A local attacker with permissions to modify network disciplines (typically requiring CAP_NET_ADMIN) can exploit this to trigger a kernel oops and system crash. The fix involves reordering operations to purge idle queues before assigning the new 'nbands' and 'nstrict' values.
Affected products
- Linux Linux Kernel 5.11 to 5.15.190, 6.2 to 6.6.103, 6.7 to 6.12.43, 6.13 to 6.15.11
Timeline
- 2025-08-12: patched: Initial patch authored by Davide Caratti
- 2025-09-04: advisory: NVD publication date
References
- https://git.kernel.org/stable/c/5b3b346bc4c2aa2c428735438a11989d251f32f1
- https://git.kernel.org/stable/c/84a24fb446ee07b22b64aae6f0e3f4a38266310a
- https://git.kernel.org/stable/c/87c6efc5ce9c126ae4a781bc04504b83780e3650
- https://git.kernel.org/stable/c/970c1c731c4ede46d05f5b0355724d1e400cfbca
- https://git.kernel.org/stable/c/97ec167cd2e8a81a2d87331a2ed92daf007542c8
- https://git.kernel.org/stable/c/bdfddcde86e8b9245d9c0c2efe2b6fe8dcf6bf41
- https://git.kernel.org/stable/c/be9692dafdfb36d9c43afd9d4e1d9d9ba8e7b51b