CVE-2025-37992

What it actually does

Incomplete queue trimming in qdisc ->change() leaves packets in the gso_skb list, causing a NULL pointer dereference when sch->limit is compared only against sch->q.qlen during subsequent operations.

Why it matters to the business

Linux-based network appliances or cloud instances may experience kernel crashes or traffic processing failures when qdisc limits are dynamically reduced, potentially disrupting connectivity or requiring reboots.

How an attack unfolds

An attacker with local access or the ability to influence qdisc configuration triggers a limit reduction via netlink while packets reside in the gso_skb list; the missing flush in the updated qdiscs allows the dereference on next dequeue or check, leading to a crash or memory corruption that could be chained for privilege escalation in kernel contexts.

How to fix it

Upgrade linux-aws-5.15 packages on Ubuntu 20.04 LTS to version 5.15.0-1073.79~20.04.1 or later; rebuild and redeploy any custom kernels or modules that implement affected qdiscs (codel, fq, fq_codel, fq_pie, hhf, pie) to incorporate the qdisc_dequeue_internal helper.

How to confirm the fix worked

Confirm package version is at or above the fixed release, then exercise qdisc change operations that reduce limits while monitoring for kernel oops or NULL dereference panics; review qdisc source for presence of the new helper in ->change routines.

Typical attack path

1. Obtain local or network-adjacent access to influence traffic shaping configuration
2. Issue qdisc change operation that reduces the configured limit
3. Ensure gso_skb list contains pending packets at the time of the change
4. Trigger subsequent queue operations that perform the sch->limit vs sch->q.qlen check
5. Exploit resulting NULL dereference for denial of service or escalation

How to detect it

Search kernel logs and audit trails for NULL pointer dereference panics or oops messages referencing qdisc, sch->limit, or gso_skb during qdisc change operations; correlate with netlink configuration events that alter qdisc limits.

What your security team should do

• Prioritize upgrade of all linux-aws-5.15 instances to 5.15.0-1073.79~20.04.1 within standard maintenance windows given low EPSS and no KEV listing
• Audit custom or third-party qdisc implementations for similar incomplete flushing logic
• Monitor kernel logs for qdisc-related NULL pointer dereference events as a temporary detection measure