CVE-2025-39677 net/sched: Fix backlog accounting in qdisc_dequeue_internal

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple CVEs Addressed in Networking Code Fixes Two vulnerabilities in networking code have been published, affecting the Linux kernel. CVE-2025-39677, published on September 5, 2025, addresses backlog accounting issues, while CVE-2025-37798, published on May 2, 2025, removes a specific check in the codel queue discipline. These vulnerabilities may impact systems utilizing these networking components. 2 sources 41