Linux Kernel HFSC Queue Length Notification Idempotence Vulnerability

Vulnerability

A vulnerability in the Linux kernel's Hierarchical Fair Service Curve (HFSC) scheduling class has been addressed. The issue arose because the function hfsc_qlen_notify() was not idempotent and posed challenges for its callers, such as fq_codel_dequeue(). The function has been modified to be idempotent, simplifying the interaction for callers that need to reduce backlog in the queue discipline tree. The update ensures that the function only decreases the active node count when it is non-zero, and safely removes the corresponding Red-Black tree node by using a combination of checks and clear commands.

Impact

The vulnerability's resolution improves the efficiency and reliability of queue management in the HFSC scheduling class, particularly for functions that interact with the queue discipline tree.

Added: Jul 4, 2025, 1:48 PM
Updated: Jul 4, 2025, 1:48 PM

Vulnerability Rating

Custom Algorithm
spread
9.0
impact
2.5
exploitability
5.3
remediation
0.0
relevance
0.2
threat
3.2
urgency
2.9
incentive
1.7

Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.