CVE-2025-21702

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: pfifo_tail_enqueue: Drop new packet when sch->limit == 0 Expected behaviour: In case we reach scheduler's limit, pfifo_tail_enqueue() will drop a packet in scheduler's queue and decrease scheduler's qlen by one. Then, pfifo_tail_enqueue() enqueue new packet and increase scheduler's qlen by one. Finally, pfifo_tail_enqueue() return `NET_XMIT_CN` status code. Weird behaviour: In case we set `sch->limit == 0` and trigger pfifo_tail_enqueue() on a scheduler that has no packet, the 'drop a packet' step will do nothing. This mean...

Affected product and versions

Product

Linux Linux, SIMATIC S7-1500 CPU 1518-4 PN/DP MFP, SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP

Affected versions

>= 57dbb2d83d100ea601c54fe129bfde0678db5dee < 78285b53266d6d51fa4ff504a23df03852eba84e, >= 57dbb2d83d100ea601c54fe129bfde0678db5dee < 7a9723ec27aff5674f1fd4934608937f1d650980, >= 57dbb2d83d100ea601c54fe129bfde0678db5dee < a56a6e8589a9b98d8171611fbcc1e45a15fd2455, >= 57dbb2d83d100ea601c54fe129bfde0678db5dee < 020ecb76812a0526f4130ab5aeb6dc7c773e7ab9, >= 57dbb2d83d100ea601c54fe129bfde0678db5dee < 79a955ea4a2e5ddf4a36328959de0de496419888, >= 57dbb2d83d100ea601c54fe129bfde0678db5dee < e40cb34b7f247fe2e366fd192700d1b4f38196ca, >= 57dbb2d83d100ea601c54fe129bfde0678db5dee < b6a079c3b6f95378f26e2aeda520cb3176f7067b, >= 57dbb2d83d100ea601c54fe129bfde0678db5dee < 647cef20e649c576dff271e018d5d15d998b629d, >= 2.6.34, >= V3.1.5, >= V3.1.6, >= 2.6.34 < 5.4.291, >= 5.5 < 5.10.235, >= 5.11 < 5.15.179, >= 5.16 < 6.1.130, >= 6.2 < 6.6.83, >= 6.7 < 6.12.14, >= 6.13 < 6.13.3, 6.14

Fixed versions

5.4.291, 5.10.235, 5.15.179, 6.1.130, 6.6.83, 6.12.14, 6.13.3

Technical data

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

Not available