ZeroDay Findings
Sign inSign up

Findings

CVE-2024-53057

In the Linux kernel, the following vulnerability has been resolved: net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT In qdisc_tree_reduce_backlog, Qdiscs with major handle ff

Published Nov 19, 2024 · updated Oct 15, 2026 · Amazon Amazon Linux

In the Linux kernel, the following vulnerability has been resolved: net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT In qdisc_tree_reduce_backlog, Qdiscs with major handle ffff: are assumed to be either root or ingress. This assumption is bogus since it's valid to create egress qdiscs with major handle ffff: Budimir Markovic found that for qdiscs like DRR that maintain an active class list, it will cause a UAF with a dangling class pointer. In 066a3b5b2346, the concern was to avoid iterating over the ingress qdisc since its parent is itself. The proper fix is to stop when parent TC_H_ROOT is reached because the only way to retrieve ingress is when a hierarchy which does not contain a ffff: major handle call into qdisc_lookup with TC_H_MAJ(TC_H_ROOT). In the scenario where major ffff: is an egress qdisc in any of the tree levels, the updates will also propagate to TC_H_ROOT, which then the iteration must stop. net/sched/sch_api.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Nov 19, 2024 · NIST NVD

    Detected

    In the Linux kernel, the following vulnerability has been resolved: net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT In qdisc_tree_reduce_backlog, Qdiscs with major handle ffff: are assumed to be either root or ingress. This assumption is bogus since it's valid to create egress qdiscs with major handle ffff: Budimir Markovic found that for qdiscs like DRR that maintain an active class list,

  2. Oct 15, 2026 · NIST NVD

    Updated

    In the Linux kernel, the following vulnerability has been resolved: net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT In qdisc_tree_reduce_backlog, Qdiscs with major handle ffff: are assumed to be either root or ingress. This assumption is bogus since it's valid to create egress qdiscs with major handle ffff: Budimir Markovic found that for qdiscs like DRR that maintain an active class list,

Affected

  • cpe linux/linux kernelversion unspecified
  • cpe linux/linux kernel6.12

Sources

  • Amazon LinuxVendor advisoryCVE-2024-53057

    CVE-2022-49179, CVE-2022-49390, CVE-2022-49720, CVE-2024-49883, CVE-2024-50033, CVE-2024-53057, CVE-2024-53103, CVE-2024-56650, CVE-2024-56658, CVE-2024-57979, CVE-2025-21731, CVE-2025-21753, CVE-2025-21760, CVE-2025-21762, CVE-2025-21764

    alas.aws.amazon.com
  • CVE.orgVulnerability recordCVE-2024-53057

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2024-53057

    30-day exploitation probability 0.3%

    first.org
  • NIST NVDVulnerability recordCVE-2024-53057

    In the Linux kernel, the following vulnerability has been resolved: net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT In qdisc_tree_reduce_backlog, Qdiscs with major handle ffff: are assumed to be either root or ingress. This assumption is bogus since it's valid to create

    nvd.nist.gov

References

CVE-2024-53057 · ZeroDay Findings