What’s Vulnerable › Vulnerabilities

CVE-2025-37932: sch_htb: make htb_qlen_notify() idempotent

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-05-20 · updated 2026-06-17

Description

In the Linux kernel, the following vulnerability has been resolved: sch_htb: make htb_qlen_notify() idempotent htb_qlen_notify() always deactivates the HTB class and in fact could trigger a warning if it is already deactivated. Therefore, it is not idempotent and not friendly to its callers, like fq_codel_dequeue(). Let's make it idempotent to ease qdisc_tree_reduce_backlog() callers' life.

Affected products

• Debian Linux: 11.0
• Linux kernel: before 5.4.294; from 5.5 before 5.10.241; from 5.11 before 5.15.190; from 5.16 before 6.1.138; from 6.2 before 6.6.90; from 6.7 before 6.12.28 — fixed in 5.10.241, 5.15.190, 5.4.294, 6.1.138, 6.12.28, 6.14.6

How to fix

Upgrade to a fixed version: Linux kernel 5.10.241, 5.15.190, 5.4.294, 6.1.138. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/0a188c0e197383683fd093ab1ea6ce9a5869a6ea
• https://git.kernel.org/stable/c/32ae12ce6a9f6bace186ca7335220ff59b6cc3cd
• https://git.kernel.org/stable/c/5ba8b837b522d7051ef81bacf3d95383ff8edce5
• https://git.kernel.org/stable/c/73cf6af13153d62f9b76eff422eea79dbc70f15e
• https://git.kernel.org/stable/c/967955c9e57f8eebfccc298037d4aaf3d42bc1c9
• https://git.kernel.org/stable/c/a61f1b5921761fbaf166231418bc1db301e5bf59
• https://git.kernel.org/stable/c/bbbf5e0f87078b715e7a665d662a2c0e77f044ae
• https://git.kernel.org/stable/c/e6b45f4de763b00dc1c55e685e2dd1aaf525d3c1
• https://lists.debian.org/debian-lts-announce/2025/08/msg00010.html
• https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html

Get alerted when CVE-2025-37932 or the next vulnerability affects your stack