CVE-2025-68325 net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop
A logic error in the Linux kernel's CAKE qdisc can cause a NULL pointer dereference, leading to a system crash or denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-68325?
CVE-2025-68325 is a vulnerability in Linux, published on 18 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop
In cake_drop(), qdisc_tree_reduce_backlog() is used to update the qlen and backlog of the qdisc hierarchy. Its caller, cake_enqueue(), assumes that the parent qdisc will enqueue the current packet. However, this assumption breaks when cake_enqueue() returns NET_XMIT_CN: the parent qdisc stops enqueuing current packet, leaving the tree qlen/backlog accounting inconsistent. This mismatch can lead to a NULL dereference (e.g., when the parent Qdisc is qfq_qdisc).
This patch computes the qlen/backlog delta in a more robust way by observing the difference before and after the series of cake_drop() calls, and then compensates the qdisc tree accounting if cake_enqueue() returns NET_XMIT_CN.
To ensure correct compensation when ACK thinning is enabled, a new variable is introduced to keep qlen unchanged.
Which versions are affected by CVE-2025-68325?
How do I fix CVE-2025-68325?
Apply the vendor's patch.
Is CVE-2025-68325 being exploited?
There is no known exploitation of CVE-2025-68325 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as BELL-CVE-2025-68325, DEBIAN-CVE-2025-68325, GHSA-vwv2-fc39-c5f6, ROOT-OS-DEBIAN-11-CVE-2025-68325, ROOT-OS-DEBIAN-12-CVE-2025-68325, ROOT-OS-DEBIAN-13-CVE-2025-68325 and 3 more.