The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - net/sched: Fix backlog accounting in qdisc_dequeue_internal This issue applies for the following qdiscs:
    hhf, fq, fq_codel, and fq_pie, and occurs in their change handlers when adjusting to the new limit. The     problem is the following in the values passed to the subsequent qdisc_tree_reduce_backlog call given a tbf     parent: When the tbf parent runs out of tokens, skbs of these qdiscs will be placed in gso_skb. Their peek     handlers are qdisc_peek_dequeued, which accounts for both qlen and backlog. However, in the case of     qdisc_dequeue_internal, ONLY qlen is accounted for when pulling from gso_skb. This means that these qdiscs     are missing a qdisc_qstats_backlog_dec when dropping packets to satisfy the new limit in their change     handlers. One can observe this issue with the following (with tc patched to support a limit of 0): export     TARGET=fq tc qdisc del dev lo root tc qdisc add dev lo root handle 1: tbf rate 8bit burst 100b latency 1ms     tc qdisc replace dev lo handle 3: parent 1:1 $TARGET limit 1000 echo ''; echo 'add child'; tc -s -d qdisc     show dev lo ping -I lo -f -c2 -s32 -W0.001 127.0.0.1 2>&1 >/dev/null echo ''; echo 'after ping'; tc -s -d     qdisc show dev lo tc qdisc change dev lo handle 3: parent 1:1 $TARGET limit 0 echo ''; echo 'after limit     drop'; tc -s -d qdisc show dev lo tc qdisc replace dev lo handle 2: parent 1:1 sfq echo ''; echo 'post     graft'; tc -s -d qdisc show dev lo The second to last show command shows 0 packets but a positive number     (74) of backlog bytes. The problem becomes clearer in the last show command, where qdisc_purge_queue     triggers qdisc_tree_reduce_backlog with the positive backlog and causes an underflow in the tbf parent's     backlog (4096 Mb instead of 0). To fix this issue, the codepath for all clients of qdisc_dequeue_internal     has been simplified: codel, pie, hhf, fq, fq_pie, and fq_codel. qdisc_dequeue_internal handles the backlog     adjustments for all cases that do not directly use the dequeue handler. The old fq_codel_change limit     adjustment loop accumulated the arguments to the subsequent qdisc_tree_reduce_backlog call through the     cstats field. However, this is confusing and error prone as fq_codel_dequeue could also potentially mutate     this field (which qdisc_dequeue_internal calls in the non gso_skb case), so we have unified the code here     with other qdiscs. (CVE-2025-39677)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2025-39677

high Nessus Plugin ID 261622

Version 1.9

Version 1.8

Version 1.5

Version 1.1

Version 1.9 Oct 29, 2025, 3:03 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202510290303
Version 1.8 Oct 27, 2025, 11:56 PM Detection (updated detection logic) Plugin Feed: 202510272356
Version 1.5 Sep 21, 2025, 8:29 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202509210829
Version 1.1 Sep 6, 2025, 7:55 PM New Plugin Feed: 202509061955