Homepage

NULL Pointer Dereference The advisory has been revoked - it doesn't affect any version of package kernel  (opens in a new tab)

Threat Intelligence

EPSS
0.18% (8th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-RHEL6-KERNEL-10190311
  • published21 May 2025
  • disclosed20 May 2025
Report a new vulnerability Found a mistake?

Introduced: 20 May 2025

CVE-2025-37953  (opens in a new tab)
CWE-476  (opens in a new tab)

Amendment

The Red Hat security team deemed this advisory irrelevant for RHEL:6.

NVD Description

Note: Versions mentioned in the description apply only to the upstream kernel package and not the kernel package as distributed by RHEL.

In the Linux kernel, the following vulnerability has been resolved:

sch_htb: make htb_deactivate() idempotent

Alan reported a NULL pointer dereference in htb_next_rb_node() after we made htb_qlen_notify() idempotent.

It turns out in the following case it introduced some regression:

htb_dequeue_tree(): |-> fq_codel_dequeue() |-> qdisc_tree_reduce_backlog() |-> htb_qlen_notify() |-> htb_deactivate() |-> htb_next_rb_node() |-> htb_deactivate()

For htb_next_rb_node(), after calling the 1st htb_deactivate(), the clprio[prio]->ptr could be already set to NULL, which means htb_next_rb_node() is vulnerable here.

For htb_deactivate(), although we checked qlen before calling it, in case of qlen==0 after qdisc_tree_reduce_backlog(), we may call it again which triggers the warning inside.

To fix the issues here, we need to:

  1. Make htb_deactivate() idempotent, that is, simply return if we already call it before.
  2. Make htb_next_rb_node() safe against ptr==NULL.

Many thanks to Alan for testing and for the reproducer.