Critical Vulnerability in Linux Kernel Affecting Debian Packages: CVE-2025-39677
Summary
CVE-2025-39677: In the Linux kernel, the following vulnerability has been resolved: net/sched: Fix backlog accounting in qdisc_dequeue_internal This issue applies for the following qdiscs: hhf, fq, fq_codel, and fq_pie, and occurs in th... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Linux kernel is the core component of the Debian operating system, responsible for managing hardware resources and providing essential services to applications. It supports a wide range of functionalities, including process management, memory management, and device control. This vulnerability specifically impacts the networking subsystem, particularly in the queuing disciplines (qdiscs) used for packet scheduling, which are crucial for managing network traffic efficiently.
Vulnerability Detail
CVE-2025-39677 is a vulnerability in the Linux kernel's networking subsystem, specifically affecting the backlog accounting in the qdisc_dequeue_internal function. This issue arises when certain queuing disciplines (hhf, fq, fq_codel, and fq_pie) fail to properly account for packet backlog when adjusting to new limits. As a result, when the token bucket filter (tbf) parent runs out of tokens, packets can be incorrectly accounted, leading to potential underflows in backlog statistics. This can disrupt network traffic management and lead to degraded performance or unexpected behavior in network applications.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. However, monitoring network traffic and adjusting configurations may help mitigate some impacts until a patch is applied.
Conclusion
CVE-2025-39677 is a critical vulnerability in the Linux kernel affecting Debian packages, specifically related to network traffic management. It is essential for users to update their systems to the latest patched version to ensure security and optimal performance. Regular monitoring and updates are crucial for maintaining system integrity.
See every vulnerability recorded for linux →
FAQ
CVE-2025-39677 is a vulnerability in the Linux kernel that affects the backlog accounting in certain queuing disciplines, potentially leading to network performance issues.
The vulnerability affects multiple Debian versions, including Debian 11, 12, 13, and 14.
You can use tools like Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability.
The vulnerability can lead to improper backlog accounting, which may result in degraded network performance and unexpected behavior in applications relying on network traffic management.
Yes, a patch is available. It is recommended to update the Linux package to the latest version to mitigate the vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
