CVE-2025-39677

一、漏洞信息
 漏洞编号：[CVE-2025-39677](https://nvd.nist.gov/vuln/detail/CVE-2025-39677)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.19,6.4.0,6.6.0
 CVSS V3.x分值：
  BaseScore：5.5 Medium
  Vector：CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:net/sched: Fix backlog accounting in qdisc_dequeue_internalThis issue applies for the following qdiscs: hhf, fq, fq_codel, andfq_pie, and occurs in their change handlers when adjusting to the newlimit. The problem is the following in the values passed to thesubsequent qdisc_tree_reduce_backlog call given a tbf parent:   When the tbf parent runs out of tokens, skbs of these qdiscs will   be placed in gso_skb. Their peek handlers are qdisc_peek_dequeued,   which accounts for both qlen and backlog. However, in the case of   qdisc_dequeue_internal, ONLY qlen is accounted for when pulling   from gso_skb. This means that these qdiscs are missing a   qdisc_qstats_backlog_dec when dropping packets to satisfy the   new limit in their change handlers.   One can observe this issue with the following (with tc patched to   support a limit of 0):   export TARGET=fq   tc qdisc del dev lo root   tc qdisc add dev lo root handle 1: tbf rate 8bit burst 100b latency 1ms   tc qdisc replace dev lo handle 3: parent 1:1 $TARGET limit 1000   echo   ; echo  add child ; tc -s -d qdisc show dev lo   ping -I lo -f -c2 -s32 -W0.001 127.0.0.1 2>&1 >/dev/null   echo   ; echo  after ping ; tc -s -d qdisc show dev lo   tc qdisc change dev lo handle 3: parent 1:1 $TARGET limit 0   echo   ; echo  after limit drop ; tc -s -d qdisc show dev lo   tc qdisc replace dev lo handle 2: parent 1:1 sfq   echo   ; echo  post graft ; tc -s -d qdisc show dev lo   The second to last show command shows 0 packets but a positive   number (74) of backlog bytes. The problem becomes clearer in the   last show command, where qdisc_purge_queue triggers   qdisc_tree_reduce_backlog with the positive backlog and causes an   underflow in the tbf parent s backlog (4096 Mb instead of 0).To fix this issue, the codepath for all clients of qdisc_dequeue_internalhas been simplified: codel, pie, hhf, fq, fq_pie, and fq_codel.qdisc_dequeue_internal handles the backlog adjustments for all cases thatdo not directly use the dequeue handler.The old fq_codel_change limit adjustment loop accumulated the arguments tothe subsequent qdisc_tree_reduce_backlog call through the cstats field.However, this is confusing and error prone as fq_codel_dequeue could alsopotentially mutate this field (which qdisc_dequeue_internal calls in thenon gso_skb case), so we have unified the code here with other qdiscs.
 漏洞公开时间：2025-09-06 02:15:44
 漏洞创建时间：2025-09-06 02:10:14
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2025-39677
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-39684 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-38058 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-38005 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-38501 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-40104 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-37861 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2024-49894 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-40155 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-38109 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2024-57900 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-38350 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-22020 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-39994 |  |
|  | https://git.kernel.org/stable/c/52bf272636bda69587952b35ae97690b8dc89941 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2024-38667 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-40049 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-40149 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2024-38584 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2024-42245 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2024-49863 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-39677 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-40061 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-38664 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-21945 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-23133 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-38231 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2024-41079 |  |
|  | https://lore.kernel.org/linux-cve-announce/2025090544-CVE-2025-39677-5733@gregkh/T/#u |  |
|  | https://git.kernel.org/stable/c/a225f44d84b8900d679c5f5a9ea46fe9c0cc7802 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2024-49957 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-40075 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-38470 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-39947 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-40121 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2024-40902 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-39817 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2024-42297 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-38071 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-40074 |  |
|  | https://lore.kernel.org/linux-cve-announce/2025090544-CVE-2025-39677-5733@gregkh/T |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-38361 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-40139 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-38282 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2024-57887 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-37758 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-40135 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-22025 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2024-38633 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-23147 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-21968 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-38614 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2024-38381 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2024-49962 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-37997 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2024-50002 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-22083 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-22039 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-40058 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-40158 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-39866 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-39881 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-21693 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2024-42101 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-39697 |  |
|  | https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2803 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-39825 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-38443 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2024-49935 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-37899 |  |
|  | https://git.kernel.org/linus/52bf272636bda69587952b35ae97690b8dc89941 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2024-49925 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-40052 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-38457 |  |
|  | http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39677 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-23159 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-38706 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2024-49905 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-38477 |  |
|  | https://bugzilla.redhat.com/show_bug.cgi?id=2393536 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-22042 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2024-40904 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-39911 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2024-49950 |  |
|  | https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2776 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-38588 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-38636 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2024-38615 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2024-49948 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-22107 |  |
|  | https://docs.bell-sw.com/security/cves/CVE-2025-39677 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-38566 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2024-49949 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2024-53131 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2024-38659 |  |
|  | https://ubuntu.com/security/CVE-2025-39677 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-38527 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-38727 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-22043 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-39810 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2024-42102 |  |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  七彩瞬析开源风险感知平台
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
| gregkh/linux |  | https://github.com/gregkh/linux/commit/a225f44d84b8900d679c5f5a9ea46fe9c0cc7802.patch |  | ljqc |
|  |  | https://git.kernel.org/stable/c/52bf272636bda69587952b35ae97690b8dc89941 |  | cvelistv5 |
|  |  | https://git.kernel.org/stable/c/a225f44d84b8900d679c5f5a9ea46fe9c0cc7802 |  | cvelistv5 |
|  |  | https://git.kernel.org/linus/52bf272636bda69587952b35ae97690b8dc89941 |  | osv |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
  In the Linux kernel, the following vulnerability has been resolved:net/sched: Fix backlog accounting in qdisc_dequeue_internalThis issue applies for the following qdiscs: hhf, fq, fq_codel, andfq_pie, and occurs in their change handlers when adjusting to the newlimit. The problem is the following in the values passed to thesubsequent qdisc_tree_reduce_backlog call given a tbf parent:When the tbf parent runs out of tokens, skbs of these qdiscs willbe placed in gso_skb. Their peek handlers are qdisc_peek_dequeued,which accounts for both qlen and backlog. However, in the case ofqdisc_dequeue_internal, ONLY qlen is accounted for when pullingfrom gso_skb. This means that these qdiscs are missing aqdisc_qstats_backlog_dec when dropping packets to satisfy thenew limit in their change handlers.One can observe this issue with the following (with tc patched tosupport a limit of 0):export TARGET=fqtc qdisc del dev lo roottc qdisc add dev lo root handle 1: tbf rate 8bit burst 100b latency 1mstc qdisc replace dev lo handle 3: parent 1:1 TARGET limit 1000 echo   ; echo  add child ; tc -s -d qdisc show dev lo ping -I lo -f -c2 -s32 -W0.001 127.0.0.1 2>&1 >/dev/null echo   ; echo  after ping ; tc -s -d qdisc show dev lo tc qdisc change dev lo handle 3: parent 1:1TARGET limit 0echo   ; echo  after limit drop ; tc -s -d qdisc show dev lotc qdisc replace dev lo handle 2: parent 1:1 sfqecho   ; echo  post graft ; tc -s -d qdisc show dev loThe second to last show command shows 0 packets but a positivenumber (74) of backlog bytes. The problem becomes clearer in thelast show command, where qdisc_purge_queue triggersqdisc_tree_reduce_backlog with the positive backlog and causes anunderflow in the tbf parent s backlog (4096 Mb instead of 0).To fix this issue, the codepath for all clients of qdisc_dequeue_internalhas been simplified: codel, pie, hhf, fq, fq_pie, and fq_codel.qdisc_dequeue_internal handles the backlog adjustments for all cases thatdo not directly use the dequeue handler.The old fq_codel_change limit adjustment loop accumulated the arguments tothe subsequent qdisc_tree_reduce_backlog call through the cstats field.However, this is confusing and error prone as fq_codel_dequeue could alsopotentially mutate this field (which qdisc_dequeue_internal calls in thenon gso_skb case), so we have unified the code here with other qdiscs.
 openEuler评分：
  5.5
 Vector：CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
 受影响版本排查(受影响/不受影响)：
  1.openEuler-20.03-LTS-SP4(4.19.90):受影响
2.openEuler-22.03-LTS-SP3(5.10.0):受影响
3.openEuler-22.03-LTS-SP4(5.10.0):受影响
4.openEuler-24.03-LTS(6.6.0):受影响
5.openEuler-24.03-LTS-SP1(6.6.0):受影响
6.openEuler-24.03-LTS-SP2(6.6.0):受影响
7.openEuler-24.03-LTS-SP3(6.6.0):不受影响
8.master(6.12.33):不受影响
9.openEuler-24.03-LTS-Next(6.6.0):不受影响

修复是否涉及abi变化(是/否)：
  1.master(6.12.33):否
2.openEuler-20.03-LTS-SP4(4.19.90):否
3.openEuler-22.03-LTS-SP3(5.10.0):否
4.openEuler-22.03-LTS-SP4(5.10.0):否
5.openEuler-24.03-LTS(6.6.0):否
6.openEuler-24.03-LTS-Next(6.6.0):否
7.openEuler-24.03-LTS-SP1(6.6.0):否
8.openEuler-24.03-LTS-SP2(6.6.0):否
9.openEuler-24.03-LTS-SP3(6.6.0):否

原因说明：
  1.openEuler-24.03-LTS(6.6.0):正常修复
2.openEuler-24.03-LTS-SP1(6.6.0):正常修复
3.openEuler-24.03-LTS-SP2(6.6.0):正常修复
4.openEuler-24.03-LTS-SP3(6.6.0):不受影响-漏洞代码不能被攻击者触发
5.openEuler-20.03-LTS-SP4(4.19.90):不修复-超出修复范围
6.openEuler-22.03-LTS-SP3(5.10.0):不修复-超出修复范围
7.openEuler-22.03-LTS-SP4(5.10.0):不修复-超出修复范围
8.master(6.12.33):不受影响-漏洞代码不能被攻击者触发
9.openEuler-24.03-LTS-Next(6.6.0):不受影响-漏洞代码不能被攻击者触发

三、漏洞修复
安全公告链接：https://www.openeuler.org/zh/security/safety-bulletin/detail/?id=openEuler-SA-2025-2803

src-openEuler/kernel
关闭

内容风险标识

评论 (31)

src-openEuler/kernel关闭 .gitee-modal { width: 500px !important; }

内容风险标识

CVE-2025-39677

评论 (31)

搜索帮助

src-openEuler/kernel
关闭