CVE-2025-37932 Details
Description
In the Linux kernel, the following vulnerability has been resolved: sch_htb: make htb_qlen_notify() idempotent htb_qlen_notify() always deactivates the HTB class and in fact could trigger a warning if it is already deactivated. Therefore, it is not idempotent and not friendly to its callers, like fq_codel_dequeue(). Let's make it idempotent to ease qdisc_tree_reduce_backlog() callers' life.
A vulnerability in the Linux kernel's Hierarchical Token Bucket (HTB) scheduling class has been addressed. The issue arose because the function 'htb_qlen_notify()' was not idempotent; it always deactivated the HTB class, potentially triggering a warning if the class was already deactivated. This behavior was problematic for callers like 'fq_codel_dequeue()'. The function has now been modified to be idempotent, improving compatibility with 'qdisc_tree_reduce_backlog()' callers.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/0a188c0e197383683fd093ab1ea6ce9a5869a6ea | kernel.org | Patch |
| https://git.kernel.org/stable/c/32ae12ce6a9f6bace186ca7335220ff59b6cc3cd | kernel.org | Patch |
| https://git.kernel.org/stable/c/5ba8b837b522d7051ef81bacf3d95383ff8edce5 | kernel.org | Patch |
| https://git.kernel.org/stable/c/73cf6af13153d62f9b76eff422eea79dbc70f15e | kernel.org | Patch |
| https://git.kernel.org/stable/c/967955c9e57f8eebfccc298037d4aaf3d42bc1c9 | kernel.org | Patch |
| https://git.kernel.org/stable/c/a61f1b5921761fbaf166231418bc1db301e5bf59 | kernel.org | Patch |
| https://git.kernel.org/stable/c/bbbf5e0f87078b715e7a665d662a2c0e77f044ae | kernel.org | Patch |
| https://git.kernel.org/stable/c/e6b45f4de763b00dc1c55e685e2dd1aaf525d3c1 | kernel.org | Patch |
| https://lists.debian.org/debian-lts-announce/2025/08/msg00010.html | CVE | Third Party Advisory |
| https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html | CVE | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| NVD-CWE-noinfo | Insufficient Information to Classify Weakness | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | < 5.4.294 >= 5.5, < 5.10.241 >= 5.11, < 5.15.190 >= 5.16, < 6.1.138 >= 6.2, < 6.6.90 >= 6.7, < 6.12.28 >= 6.13, < 6.14.6 6.15 rc1 |
CPE
Remediation
| |
| debian debian linux | 11.0 |
CPE
Remediation
| |
Change History
7 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | kernel.org |
| Dec 19, 2025 | Initial Analysis | [email protected] |
| Nov 3, 2025 | CVE Modified | CVE |
| Nov 3, 2025 | CVE Modified | CVE |
| Aug 28, 2025 | CVE Modified | kernel.org |
| Jun 4, 2025 | CVE Modified | kernel.org |
| May 20, 2025 | New CVE Received | kernel.org |