https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 23:56:20 +0000 https://cve.radiocsirt.org/vuln/bell-cve-2025-68232 <p><strong>Affected:</strong> Alpaquita:stream: linux-lts</p> <p><strong>Affected:</strong> Alpaquita:stream: linux-lts</p> https://cve.radiocsirt.org/vuln/bell-cve-2025-68232 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0331 certfr-2026-avi-0331 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0331 https://cve.radiocsirt.org/vuln/euvd-2026-347465 EUVD-2026-347465 https://cve.radiocsirt.org/vuln/euvd-2026-347465 https://cve.radiocsirt.org/vuln/fkie_cve-2025-68232 <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>veth: more robust handing of race to avoid txq getting stuck</p> <p>Commit dc82a33297fc (&#34;veth: apply qdisc backpressure on full ptr_ring to reduce TX drops&#34;) introduced a race condition that can lead to a permanently stalled TXQ. This was observed in production on ARM64 systems (Ampere Altra Max).</p> <p>The race occurs in veth_xmit(). The producer observes a full ptr_ring and stops the queue (netif_tx_stop_queue()). The subsequent conditional logic, intended to re-wake the queue if the consumer had just emptied it (if (__ptr_ring_empty(...)) netif_tx_wake_queue()), can fail. This leads to a &#34;lost wakeup&#34; where the TXQ remains stopped (QUEUE_STATE_DRV_XOFF) and traffic halts.</p> <p>This failure is caused by an incorrect use of the __ptr_ring_empty() API from the producer side. As noted in kernel comments, this check is not guaranteed to be correct if a consumer is operating on another CPU. The empty test is based on ptr_ring-&gt;consumer_head, making it reliable only for the consumer. Using this check from the producer side is fundamentally racy.</p> <p>This patch fixes the race by adopting the more robust logic from an earlier version V4 of the patchset, which always flushed the peer:</p> <p>(1) In veth_xmit(), the racy conditional wake-up logic and its memory barrier are removed. Instead, after stopping the queue, we unconditionally call __veth_xdp_flush(rq). This guarantees that the NAPI consumer is scheduled, making it solely respons…</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>veth: more robust handing of race to avoid txq getting stuck</p> <p>Commit dc82a33297fc (&#34;veth: apply qdisc backpressure on full ptr_ring to reduce TX drops&#34;) introduced a race condition that can lead to a permanently stalled TXQ. This was observed in production on ARM64 systems (Ampere Altra Max).</p> <p>The race occurs in veth_xmit(). The producer observes a full ptr_ring and stops the queue (netif_tx_stop_queue()). The subsequent conditional logic, intended to re-wake the queue if the consumer had just emptied it (if (__ptr_ring_empty(...)) netif_tx_wake_queue()), can fail. This leads to a &#34;lost wakeup&#34; where the TXQ remains stopped (QUEUE_STATE_DRV_XOFF) and traffic halts.</p> <p>This failure is caused by an incorrect use of the __ptr_ring_empty() API from the producer side. As noted in kernel comments, this check is not guaranteed to be correct if a consumer is operating on another CPU. The empty test is based on ptr_ring-&gt;consumer_head, making it reliable only for the consumer. Using this check from the producer side is fundamentally racy.</p> <p>This patch fixes the race by adopting the more robust logic from an earlier version V4 of the patchset, which always flushed the peer:</p> <p>(1) In veth_xmit(), the racy conditional wake-up logic and its memory barrier are removed. Instead, after stopping the queue, we unconditionally call __veth_xdp_flush(rq). This guarantees that the NAPI consumer is scheduled, making it solely respons…</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-68232 https://cve.radiocsirt.org/vuln/ghsa-mrvq-mp59-qvj4 <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>veth: more robust handing of race to avoid txq getting stuck</p> <p>Commit dc82a33297fc (&#34;veth: apply qdisc backpressure on full ptr_ring to reduce TX drops&#34;) introduced a race condition that can lead to a permanently stalled TXQ. This was observed in production on ARM64 systems (Ampere Altra Max).</p> <p>The race occurs in veth_xmit(). The producer observes a full ptr_ring and stops the queue (netif_tx_stop_queue()). The subsequent conditional logic, intended to re-wake the queue if the consumer had just emptied it (if (__ptr_ring_empty(...)) netif_tx_wake_queue()), can fail. This leads to a &#34;lost wakeup&#34; where the TXQ remains stopped (QUEUE_STATE_DRV_XOFF) and traffic halts.</p> <p>This failure is caused by an incorrect use of the __ptr_ring_empty() API from the producer side. As noted in kernel comments, this check is not guaranteed to be correct if a consumer is operating on another CPU. The empty test is based on ptr_ring-&gt;consumer_head, making it reliable only for the consumer. Using this check from the producer side is fundamentally racy.</p> <p>This patch fixes the race by adopting the more robust logic from an earlier version V4 of the patchset, which always flushed the peer:</p> <p>(1) In veth_xmit(), the racy conditional wake-up logic and its memory barrier are removed. Instead, after stopping the queue, we unconditionally call __veth_xdp_flush(rq). This guarantees that the NAPI consumer is scheduled, making it solely respons…</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>veth: more robust handing of race to avoid txq getting stuck</p> <p>Commit dc82a33297fc (&#34;veth: apply qdisc backpressure on full ptr_ring to reduce TX drops&#34;) introduced a race condition that can lead to a permanently stalled TXQ. This was observed in production on ARM64 systems (Ampere Altra Max).</p> <p>The race occurs in veth_xmit(). The producer observes a full ptr_ring and stops the queue (netif_tx_stop_queue()). The subsequent conditional logic, intended to re-wake the queue if the consumer had just emptied it (if (__ptr_ring_empty(...)) netif_tx_wake_queue()), can fail. This leads to a &#34;lost wakeup&#34; where the TXQ remains stopped (QUEUE_STATE_DRV_XOFF) and traffic halts.</p> <p>This failure is caused by an incorrect use of the __ptr_ring_empty() API from the producer side. As noted in kernel comments, this check is not guaranteed to be correct if a consumer is operating on another CPU. The empty test is based on ptr_ring-&gt;consumer_head, making it reliable only for the consumer. Using this check from the producer side is fundamentally racy.</p> <p>This patch fixes the race by adopting the more robust logic from an earlier version V4 of the patchset, which always flushed the peer:</p> <p>(1) In veth_xmit(), the racy conditional wake-up logic and its memory barrier are removed. Instead, after stopping the queue, we unconditionally call __veth_xdp_flush(rq). This guarantees that the NAPI consumer is scheduled, making it solely respons…</p> https://cve.radiocsirt.org/vuln/ghsa-mrvq-mp59-qvj4 https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-68232 <p><strong>Affected:</strong> Ubuntu:16.04:LTS: linux-hwe-edge, Ubuntu:18.04:LTS: linux-aws-5.0, Ubuntu:18.04:LTS: linux-aws-5.3, Ubuntu:18.04:LTS: linux-azure, Ubuntu:18.04:LTS: linux-azure-5.3, Ubuntu:18.04:LTS: linux-azure-edge, Ubuntu:18.04:LTS: linux-gcp, Ubuntu:18.04:LTS: linux-gcp-5.3, Ubuntu:18.04:LTS: linux-gke-4.15, Ubuntu:18.04:LTS: linux-gke-5.4 and 97 more</p> <p>In the Linux kernel, the following vulnerability has been resolved: veth: more robust handing of race to avoid txq getting stuck Commit dc82a33297fc (&#34;veth: apply qdisc backpressure on full ptr_ring to reduce TX drops&#34;) introduced a race condition that can lead to a permanently stalled TXQ. This was observed in production on ARM64 systems (Ampere Altra Max). The race occurs in veth_xmit(). The producer observes a full ptr_ring and stops the queue (netif_tx_stop_queue()). The subsequent conditional logic, intended to re-wake the queue if the consumer had just emptied it (if (__ptr_ring_empty(...)) netif_tx_wake_queue()), can fail. This leads to a &#34;lost wakeup&#34; where the TXQ remains stopped (QUEUE_STATE_DRV_XOFF) and traffic halts. This failure is caused by an incorrect use of the __ptr_ring_empty() API from the producer side. As noted in kernel comments, this check is not guaranteed to be correct if a consumer is operating on another CPU. The empty test is based on ptr_ring-&gt;consumer_head, making it reliable only for the consumer. Using this check from the producer side is fundamentally racy. This patch fixes the race by adopting the more robust logic from an earlier version V4 of the patchset, which always flushed the peer: (1) In veth_xmit(), the racy conditional wake-up logic and its memory barrier are removed. Instead, after stopping the queue, we unconditionally call __veth_xdp_flush(rq). This guarantees that the NAPI consumer is scheduled, making it solely responsible f…</p> <p><strong>Affected:</strong> Ubuntu:16.04:LTS: linux-hwe-edge, Ubuntu:18.04:LTS: linux-aws-5.0, Ubuntu:18.04:LTS: linux-aws-5.3, Ubuntu:18.04:LTS: linux-azure, Ubuntu:18.04:LTS: linux-azure-5.3, Ubuntu:18.04:LTS: linux-azure-edge, Ubuntu:18.04:LTS: linux-gcp, Ubuntu:18.04:LTS: linux-gcp-5.3, Ubuntu:18.04:LTS: linux-gke-4.15, Ubuntu:18.04:LTS: linux-gke-5.4 and 97 more</p> <p>In the Linux kernel, the following vulnerability has been resolved: veth: more robust handing of race to avoid txq getting stuck Commit dc82a33297fc (&#34;veth: apply qdisc backpressure on full ptr_ring to reduce TX drops&#34;) introduced a race condition that can lead to a permanently stalled TXQ. This was observed in production on ARM64 systems (Ampere Altra Max). The race occurs in veth_xmit(). The producer observes a full ptr_ring and stops the queue (netif_tx_stop_queue()). The subsequent conditional logic, intended to re-wake the queue if the consumer had just emptied it (if (__ptr_ring_empty(...)) netif_tx_wake_queue()), can fail. This leads to a &#34;lost wakeup&#34; where the TXQ remains stopped (QUEUE_STATE_DRV_XOFF) and traffic halts. This failure is caused by an incorrect use of the __ptr_ring_empty() API from the producer side. As noted in kernel comments, this check is not guaranteed to be correct if a consumer is operating on another CPU. The empty test is based on ptr_ring-&gt;consumer_head, making it reliable only for the consumer. Using this check from the producer side is fundamentally racy. This patch fixes the race by adopting the more robust logic from an earlier version V4 of the patchset, which always flushed the peer: (1) In veth_xmit(), the racy conditional wake-up logic and its memory barrier are removed. Instead, after stopping the queue, we unconditionally call __veth_xdp_flush(rq). This guarantees that the NAPI consumer is scheduled, making it solely responsible f…</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-68232 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-2868 <p>Ein Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um nicht näher spezifizierte Angriffe durchzuführen, die möglicherweise zu einer Denial-of-Service- Bedingung führen oder eine Speicherbeschädigung verursachen können.</p> <p>Ein Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um nicht näher spezifizierte Angriffe durchzuführen, die möglicherweise zu einer Denial-of-Service- Bedingung führen oder eine Speicherbeschädigung verursachen können.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2025-2868