CVE-2025-39766

What it actually does

Incorrect return value from cake_enqueue (NET_XMIT_SUCCESS instead of NET_XMIT_CN) when buffer_limit is exceeded allows htb_activate to be invoked on an empty child qdisc, violating the !cl->leaf.q->q.qlen assumption and triggering kernel warnings or instability in traffic control paths.

Why it matters to the business

Organizations running affected Linux kernels, especially in containerized or MinimOS environments with high network throughput, face elevated risk of system instability, log flooding, and potential local privilege escalation; threat actors including VMSCAPE have targeted similar kernel issues, and the 411-day exposure window plus container prevalence increases operational disruption and remediation urgency.

How an attack unfolds

An attacker with local access configures HTB and CAKE qdiscs with an extremely low memlimit on a network interface, then generates rapid local traffic (such as flood pings) to force packet drops; this causes cake_enqueue to return the wrong status, allowing htb_enqueue to activate an empty queue and trigger the warning condition, which can be chained with other kernel flaws for privilege escalation as seen in campaigns like CVE-2025-39682.

How to fix it

Upgrade to fixed versions: atlantis (MinimOS) 0.33.0-r0, atlantis-oci-entrypoint (MinimOS) 0.33.0-r0, or Linux kernel commit 7689ab22de36f8db19095f6bdf11f28cfde92f5c; rebuild and reboot systems, then verify qdisc configurations no longer trigger the condition.

How to confirm the fix worked

Confirm kernel version or package matches a fixed release, reproduce the provided tc and ping reproducer to ensure no WARNING appears in dmesg, and audit qdisc setups for low memlimit values.

Typical attack path

1. Obtain local access on a vulnerable Linux system
2. Delete and re-add root qdisc with HTB default class
3. Attach CAKE qdisc with memlimit 1b to the HTB class
4. Generate high-rate local traffic to exceed buffer_limit
5. Trigger kernel warning via empty qdisc activation
6. Chain with additional kernel primitives for escalation

How to detect it

Search kernel logs and dmesg for WARNING messages originating from htb_activate when qlen checks fail, correlate with tc qdisc configuration changes or sudden local traffic spikes, and review audit logs for unusual qdisc setup sequences on container hosts.

• WARNING: at net/sched/sch_htb.c
• htb_activate
• !cl->leaf.q->q.qlen
• cake memlimit 1b
• tc qdisc add.*cake

What your security team should do

• Prioritize patching all systems within the CISA-style remediation window given the 411-day exposure and container prevalence
• Scan for and restrict use of custom qdisc configurations with low buffer limits
• Monitor for similar privilege-escalation patterns used by VMSCAPE and related actors
• Test traffic-control workloads in staging before production rollout