CVE-2025-39766: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-39766 is a denial-of-service vulnerability in the Linux kernel's network traffic control subsystem, specifically in the CAKE (Common Applications Kept Enhanced) qdisc implementation. The flaw was disclosed on September 11, 2025, and affects Linux kernel versions from 4.19 through multiple stable branches up to 6.16.3, as well as release candidates 6.17-rc1 and 6.17-rc2. It also affects Debian Linux 11.0 and Microsoft's Azure Linux 3 kernel package (azl3_kernel_6.6.96.2-2). The vulnerability carries a CVSS v3.1 base score of 7.8 (High) (Feedly, Microsoft MSRC).

The root cause is an incorrect return value in the cake_enqueue() function (CWE-703: Improper Check or Handling of Exceptional Conditions). When a packet is dropped because the CAKE qdisc's memory limit (memlimit) is set extremely low, causing buffer_limit to be exceeded, cake_enqueue() incorrectly returns NET_XMIT_SUCCESS instead of NET_XMIT_CN (congestion notification). This misleads the parent HTB (Hierarchical Token Bucket) qdisc, which then calls htb_activate() on a child qdisc with an empty queue (!cl->leaf.q->q.qlen), triggering a kernel WARNING. The issue can be reproduced locally by configuring an HTB root qdisc with a CAKE child qdisc set to a 1-byte memory limit and sending traffic through it (Feedly).

A local attacker with low privileges can exploit this vulnerability to trigger kernel warnings and disrupt network scheduling behavior, potentially causing denial-of-service conditions affecting system stability. The improper queue state management can lead to kernel crashes or instability in the network stack, impacting availability. While the CVSS score also reflects high confidentiality and integrity impact (score 7.8), the primary practical consequence is availability disruption through kernel-level instability (Feedly, Microsoft MSRC).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation as of the time of this report. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.024% (0.000240), indicating a very low probability of exploitation in the near term. Exploitation requires local access with low privileges and the ability to configure traffic control (tc) qdisc settings (Feedly).

Update the Linux kernel to a patched version across the relevant stable branches: 5.4.297 or later, 5.10.241 or later, 5.15.190 or later, 6.1.149 or later, 6.6.103 or later, 6.12.44 or later, or 6.16.4 or later. Patches are available via the Linux stable kernel repository with commits including 0dacfc5372e3, 15de71d06a40, 62d591dde4de, 710866fc0a64, 7689ab22de36, aa12ee1c1bd2, de04ddd2980b, and ff57186b2cc3. As a workaround, restrict unprivileged users from configuring advanced traffic control (tc) settings, and monitor systems for kernel warnings related to htb_activate and CAKE qdisc configuration errors (Feedly, Microsoft MSRC).