CVE-2025-39766
highpriority · track · 31EPSS 0.002 · 8 %ileDEEUNLRUUSEPSS · scored 2026-10-27
In the Linux kernel, the following vulnerability has been resolved: net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit The following setup can trigger a WARNING in htb_activate due to the condition: !cl->leaf.q->q.qlen tc qdisc del dev lo root tc qdisc add dev lo root handle 1: htb default 1 tc class add dev lo parent 1: classid 1:1 \ htb rate 64bit tc qdisc add dev lo parent 1:1 handle f: \ cake memlimit 1b ping -I lo -f -c1 -s64 -W0.001 127.0.0.1 This is because the low memlimit leads to a low buffer_limit, which causes packet dropping. However, cake_enqueue still returns NET_XMIT_SUCCESS, causing htb_enqueue to call htb_activate with an empty child qdisc. We should return NET_XMIT_CN when packets are dropped from the same tin and flow. I do not believe return value of NET_XMIT_CN is necessary for packet drops in the case of ack filtering, as that is meant to optimize performance, not to signal congestion.
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
A vendor fix is available.
- FixedSIMATIC CN 4100siemens_psirt
Update to V5.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109814144/ - FixedSIMATIC CN 4100cisa_csaf_ot
Update to V5.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109814144/
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 5.5–7.8
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (119)
Products and version ranges known to be affected.
advisories (6)
Vendor and ecosystem advisories describing this.
- NCSC-2026-0147Kwetsbaarheden verholpen in Siemens-productenNL2026-05-13csaf · ncsc_nlNL
Siemens heeft kwetsbaarheden verholpen in verschillende (OT-)producten. Het gaat onder andere om producten in de Siemens RUGGEDCOM-, SCALANCE-, SIMATIC-, SIMIT-, SINAMICS-, SIPROTEC-, SENTRON- en Solid Edge-productreeksen.
- NCSC-2026-0431Kwetsbaarheden verholpen in IBM DataPower Gateway en onderliggende componentenNL2026-10-16csaf · ncsc_nlNL
IBM heeft meerdere beveiligingsproblemen opgelost in DataPower Gateway versies 10.5 tot 11.0 en een veelvoud aan onderliggende subcomponenten.
- SSA-032379SSA-032379: Multiple Vulnerabilities in SIMATIC CN 4100 Before V5.02026-05-12csaf · siemens_psirtDE
SIMATIC CN 4100 contains multiple vulnerabilities which could potentially lead to a compromise in availability, integrity and confidentiality. Siemens has released a new version for SIMATIC CN 4100 and recommends to update to the latest version.
- WID-SEC-W-2025-2040Linux Kernel: Mehrere Schwachstellen ermöglichen Denial of ServiceDeutsch2025-09-11csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Linux Kernel ausnutzen, um Sicherheitsmechanismen zu umgehen, sowie einen Denial of Service Angriff oder andere nicht spezifizierte Angriffe durchzuführen.
- WID-SEC-W-2026-3623IBM DataPower Gateway: Mehrere SchwachstellenDeutsch2026-09-28csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in IBM DataPower Gateway ausnutzen, um beliebigen Programmcode auszuführen, erweiterte Berechtigungen zu erlangen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren oder offenzulegen, einen Denial-of-Service-Zustand auszulösen oder Cross-Site-Scripting-Angriffe durchzuführen.
- ICSA-26-134-10Siemens SIMATIC2026-05-12icsa · cisa_csaf_otUS
SIMATIC CN 4100 contains multiple vulnerabilities which could potentially lead to a compromise in availability, integrity and confidentiality. Siemens has released a new version for SIMATIC CN 4100 and recommends to update to the latest version.
also known as (4)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (29)
External citations — patches, advisories, analysis.
- https://git.kernel.org/stable/c/0dacfc5372e314d1219f03e64dde3ab495a5a25ecnnvd
- https://git.kernel.org/stable/c/15de71d06a400f7fdc15bf377a2552b0ec437cf5cnnvd
- https://git.kernel.org/stable/c/62d591dde4defb1333d202410609c4ddeae060b3cnnvd
- https://git.kernel.org/stable/c/710866fc0a64eafcb8bacd91bcb1329eb7e5035fcnnvd
- https://git.kernel.org/stable/c/7689ab22de36f8db19095f6bdf11f28cfde92f5ccnnvd
- https://git.kernel.org/stable/c/aa12ee1c1bd260943fd6ab556d8635811c332eebcnnvd
- https://git.kernel.org/stable/c/de04ddd2980b48caa8d7e24a7db2742917a8b280cnnvd
- https://git.kernel.org/stable/c/ff57186b2cc39766672c4c0332323933e5faaa88cnnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan