Linux Kernel Vulnerability in skbprio Queue Management

CVE-2025-38637

Summary

A vulnerability in the Linux kernel's skbprio implementation affects the enqueue and dequeue processing under specific conditions. When skbprio is utilized as a child queue discipline (qdisc) under Token Bucket Filter (TBF) configurations, it can lead to an assertion failure due to TBF peeking at packets without dequeuing them when tokens are unavailable. This peek action causes a mismatch between the lengths of the parent and child qdisc queues. Consequently, when a high-priority packet is processed, skbprio may present an incorrect queue length, resulting in assertion failures. The patch for this issue eliminates unnecessary strict assertions within skbprio, ensuring reliable queue management.

References