CVE-2025-40083
Full vulnerability record from the local CVENow database.
Description
In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_qfq: Fix null-deref in agg_dequeue To prevent a potential crash in agg_dequeue (net/sched/sch_qfq.c) when cl->qdisc->ops->peek(cl->qdisc) returns NULL, we check the return value before using it, similar to the existing approach in sch_hfsc.c. To avoid code duplication, the following changes are made: 1. Changed qdisc_warn_nonwc(include/net/pkt_sched.h) into a static inline function. 2. Moved qdisc_peek_len from net/sched/sch_hfsc.c to include/net/pkt_sched.h so that sch_qfq can reuse it. 3. Applied qdisc_peek_len in agg_dequeue to avoid crashing.
Severity
Not scored
CVSS score
Not available
Vulnerability status
Deferred
Source identifier
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Published
2025-10-29 14:15:54.900000
Last modified
2026-10-19 21:10:00.160000
View original CVE JSON
{
"id": "CVE-2025-40083",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-10-29T14:15:54.900",
"lastModified": "2026-10-19T21:10:00.160",
"vulnStatus": "Deferred",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: sch_qfq: Fix null-deref in agg_dequeue\n\nTo prevent a potential crash in agg_dequeue (net/sched/sch_qfq.c)\nwhen cl->qdisc->ops->peek(cl->qdisc) returns NULL, we check the return\nvalue before using it, similar to the existing approach in sch_hfsc.c.\n\nTo avoid code duplication, the following changes are made:\n\n1. Changed qdisc_warn_nonwc(include/net/pkt_sched.h) into a static\ninline function.\n\n2. Moved qdisc_peek_len from net/sched/sch_hfsc.c to\ninclude/net/pkt_sched.h so that sch_qfq can reuse it.\n\n3. Applied qdisc_peek_len in agg_dequeue to avoid crashing."
},
{
"lang": "es",
"value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nnet/sched: sch_qfq: Corrección de desreferencia nula en agg_dequeue\n\nPara prevenir un posible fallo en agg_dequeue (net/sched/sch_qfq.c) cuando cl->qdisc->ops->peek(cl->qdisc) devuelve NULL, verificamos el valor de retorno antes de usarlo, de forma similar al enfoque existente en sch_hfsc.c.\n\nPara evitar la duplicación de código, se realizan los siguientes cambios:\n\n1. Se cambió qdisc_warn_nonwc(include/net/pkt_sched.h) a una función estática en línea.\n\n2. Se movió qdisc_peek_len de net/sched/sch_hfsc.c a include/net/pkt_sched.h para que sch_qfq pueda reutilizarla.\n\n3. Se aplicó qdisc_peek_len en agg_dequeue para evitar fallos."
}
],
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "unaffected",
"programFiles": [
"include/net/pkt_sched.h",
"net/sched/sch_api.c",
"net/sched/sch_hfsc.c",
"net/sched/sch_qfq.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "462dbc9101acd38e92eda93c0726857517a24bbd",
"lessThan": "71d84658a61322e5630c85c5388fc25e4a2d08b2",
"versionType": "git",
"status": "affected"
},
{
"version": "462dbc9101acd38e92eda93c0726857517a24bbd",
"lessThan": "99fc137f178797204d36ac860dd8b31e35baa2df",
"versionType": "git",
"status": "affected"
},
{
"version": "462dbc9101acd38e92eda93c0726857517a24bbd",
"lessThan": "1bed56f089f09b465420bf23bb32985c305cfc28",
"versionType": "git",
"status": "affected"
},
{
"version": "462dbc9101acd38e92eda93c0726857517a24bbd",
"lessThan": "3c2a8994807623c7655ece205667ae2cf74940aa",
"versionType": "git",
"status": "affected"
},
{
"version": "462dbc9101acd38e92eda93c0726857517a24bbd",
"lessThan": "6ffa9d66187188e3068b5a3895e6ae1ee34f9199",
"versionType": "git",
"status": "affected"
},
{
"version": "462dbc9101acd38e92eda93c0726857517a24bbd",
"lessThan": "6ff8e74c8f8a68ec07ef837b95425dfe900d060f",
"versionType": "git",
"status": "affected"
},
{
"version": "462dbc9101acd38e92eda93c0726857517a24bbd",
"lessThan": "dd831ac8221e691e9e918585b1003c7071df0379",
"versionType": "git",
"status": "affected"
}
]
},
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "affected",
"programFiles": [
"include/net/pkt_sched.h",
"net/sched/sch_api.c",
"net/sched/sch_hfsc.c",
"net/sched/sch_qfq.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "3.8",
"status": "affected"
},
{
"version": "0",
"lessThan": "3.8",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.4.302",
"lessThanOrEqual": "5.4.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.10.247",
"lessThanOrEqual": "5.10.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.15.197",
"lessThanOrEqual": "5.15.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.1.159",
"lessThanOrEqual": "6.1.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.6.116",
"lessThanOrEqual": "6.6.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.12.57",
"lessThanOrEqual": "6.12.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.16",
"lessThanOrEqual": "*",
"versionType": "original_commit_for_fix",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-06-16T19:42:58.130867Z",
"id": "CVE-2025-40083",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"references": [
{
"url": "https://git.kernel.org/stable/c/1bed56f089f09b465420bf23bb32985c305cfc28",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/3c2a8994807623c7655ece205667ae2cf74940aa",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/6ff8e74c8f8a68ec07ef837b95425dfe900d060f",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/6ffa9d66187188e3068b5a3895e6ae1ee34f9199",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/71d84658a61322e5630c85c5388fc25e4a2d08b2",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/99fc137f178797204d36ac860dd8b31e35baa2df",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/dd831ac8221e691e9e918585b1003c7071df0379",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}