CVE-2025-68325

Vulnerability

Description

In the Linux kernel's sch_cake qdisc, the cake_drop() function calls qdisc_tree_reduce_backlog() to update the qlen and backlog of the qdisc hierarchy. However, its caller cake_enqueue() may return NET_XMIT_CN, which indicates that the parent qdisc did not enqueue the current packet. This creates an inconsistency between the qlen/backlog accounting performed by cake_drop() and the actual state of the parent qdisc, potentially leading to a NULL pointer dereference (e.g., when the parent qdisc is qfq_qdisc).

Exploitation

The vulnerability can be triggered by network traffic that causes the sch_cake qdisc to drop packets and subsequently return NET_XMIT_CN from cake_enqueue(). No special privileges are required beyond the ability to send network packets to a system using the affected qdisc configuration. The exact conditions depend on the traffic pattern and the parent qdisc in use.

Impact

A successful exploitation results in a NULL pointer dereference in the kernel, leading to a system crash (denial of service). There is no indication of privilege escalation or remote code execution.

Mitigation

The fix has been applied to the Linux kernel stable tree in commits [1], [2], [3], and [4]. Users should update their kernels to include these patches or apply the corresponding backports.