CVE-2025-39766: Linux Kernel CAKE Qdisc DOS Vulnerability

CVE-2025-39766 Overview

CVE-2025-39766 is a Linux kernel vulnerability in the net/sched subsystem. The cake_enqueue function fails to return NET_XMIT_CN when packets are dropped after exceeding the configured buffer_limit. When CAKE is used as a child qdisc under HTB with a low memlimit, htb_enqueue then calls htb_activate on an empty child qdisc, triggering a kernel WARNING via the assertion !cl->leaf.q->q.qlen. The flaw affects the Linux kernel and Debian Linux distributions. A local, authenticated user with the ability to configure traffic control disciplines can reach the vulnerable code path.

Critical Impact
Local users with traffic-control privileges can trigger kernel warnings and undefined qdisc state, impacting host stability and network scheduling integrity.

Affected Products

Linux kernel (multiple stable branches, including 6.17-rc1 and 6.17-rc2)
Debian Linux 11.0 (patched via Debian LTS)
Siemens products referenced in advisory SSA-032379

Discovery Timeline

2025-09-11 - CVE-2025-39766 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-39766

Vulnerability Analysis

The vulnerability resides in the Common Applications Kept Enhanced (CAKE) queuing discipline implemented in net/sched/sch_cake.c. When CAKE is configured with a very small memlimit, the derived buffer_limit becomes too small to hold even a single packet. Under these conditions cake_enqueue drops the incoming packet but still returns NET_XMIT_SUCCESS to its parent qdisc.

When CAKE is attached as a leaf under Hierarchical Token Bucket (HTB), htb_enqueue interprets the success return code as a successful enqueue. It subsequently invokes htb_activate on the class, which asserts that the child qdisc queue length is non-zero. Because CAKE actually discarded the packet, cl->leaf.q->q.qlen is zero, and the WARN_ON in htb_activate fires. This inconsistent state can produce noisy kernel warnings and violate qdisc invariants that other scheduling code relies upon.

The upstream fix modifies cake_enqueue to return NET_XMIT_CN when packets are dropped from the same tin and flow that produced the drop, correctly signalling congestion to the parent qdisc. ACK-filter drops intentionally continue to report success because they are a performance optimization rather than a congestion signal.

Root Cause

The root cause is an incorrect return value from cake_enqueue on buffer-limit drops. The queuing discipline reported successful enqueue for packets it had already discarded, breaking the contract expected by parent qdiscs such as HTB.

Attack Vector

Exploitation requires local access with the CAP_NET_ADMIN capability inside the affected network namespace. An attacker with permission to run tc qdisc commands can construct an HTB parent with a CAKE leaf configured with a minimal memlimit, then transmit any packet through the interface to trigger the anomaly. See the upstream commit ff57186b for the exact code path.

// No verified proof-of-concept code is published for CVE-2025-39766.
// The NVD advisory reproduces the condition using standard tc commands:
//   tc qdisc add dev lo root handle 1: htb default 1
//   tc class add dev lo parent 1: classid 1:1 htb rate 64bit
//   tc qdisc add dev lo parent 1:1 handle f: cake memlimit 1b
//   ping -I lo -f -c1 -s64 -W0.001 127.0.0.1

Detection Methods for CVE-2025-39766

Indicators of Compromise

Kernel log entries containing WARNING stack traces originating in htb_activate with the !cl->leaf.q->q.qlen assertion.
Repeated tc qdisc or tc class invocations by non-root service accounts creating CAKE qdiscs with unusually small memlimit values.
Unexpected network throughput drops on interfaces configured with nested HTB and CAKE disciplines.

Detection Strategies

Monitor dmesg and journalctl -k for kernel warnings referencing sch_htb or sch_cake functions.
Audit process execution for tc binary invocations by users other than network operators, correlated with CAP_NET_ADMIN grants.
Baseline installed kernel versions across the fleet and flag hosts still running pre-patch builds identified in the referenced upstream commits.

Monitoring Recommendations

Forward kernel ring-buffer telemetry to a central log store and alert on qdisc-related WARN_ON events.
Track container and namespace creation events that pair with new traffic-control configurations, since unprivileged user namespaces can grant CAP_NET_ADMIN inside a namespace.
Review Debian LTS and Siemens vendor advisories for build-specific package versions and enforce compliance through configuration management.

How to Mitigate CVE-2025-39766

Immediate Actions Required

Apply the vendor-supplied kernel updates referenced in the Debian LTS advisory (msg00007), Debian LTS advisory (msg00008), and Siemens SSA-032379.
Restrict CAP_NET_ADMIN to trusted administrators and disable unprivileged user namespaces where feasible using kernel.unprivileged_userns_clone=0.
Inventory hosts running nested HTB and CAKE qdisc configurations and prioritize them for patching.

Patch Information

The fix is available upstream across multiple stable branches. Reference commits include ff57186b, 0dacfc53, 15de71d0, 62d591dd, 710866fc, 7689ab22, aa12ee1c, and de04ddd2. Distribution rebuilds ship these changes; validate the installed kernel package against your vendor advisory before closing the ticket.

Workarounds

Avoid stacking CAKE beneath HTB with memlimit values below the packet MTU until the patched kernel is deployed.
Remove or replace nested HTB/CAKE configurations on production hosts if patching must be deferred.
Constrain container workloads that receive CAP_NET_ADMIN and audit their traffic-control changes with auditd rules on execve of /sbin/tc.

bash

# Verify the running kernel includes the fix and inspect existing qdiscs
uname -r
tc qdisc show | grep -E 'htb|cake'
# Remove a risky nested configuration on interface lo as a temporary measure
tc qdisc del dev lo root