net: let net.core.dev_weight always be non-zero
The following problem was encountered during stability test:
(NULL net_device): NAPI poll function process_backlog+0x0/0x530 \
returned 1, exceeding its budget of 0.
------------[ cut here ]------------
list_add double add: new=ffff88905f746f48, prev=ffff88905f746f48, \
next=ffff88905f746e40.
WARNING: CPU: 18 PID: 5462 at lib/list_debug.c:35 \
__list_add_valid_or_report+0xf3/0x130
CPU: 18 UID: 0 PID: 5462 Comm: ping Kdump: loaded Not tainted 6.13.0-rc7+
RIP: 0010:__list_add_valid_or_report+0xf3/0x130
Call Trace:
? __warn+0xcd/0x250
? __list_add_valid_or_report+0xf3/0x130
enqueue_to_backlog+0x923/0x1070
netif_rx_internal+0x92/0x2b0
__netif_rx+0x15/0x170
loopback_xmit+0x2ef/0x450
dev_hard_start_xmit+0x103/0x490
__dev_queue_xmit+0xeac/0x1950
ip_finish_output2+0x6cc/0x1620
ip_output+0x161/0x270
ip_push_pending_frames+0x155/0x1a0
raw_sendmsg+0xe13/0x1550
__sys_sendto+0x3bf/0x4e0
__x64_sys_sendto+0xdc/0x1b0
do_syscall_64+0x5b/0x170
entry_SYSCALL_64_after_hwframe+0x76/0x7e
The reproduction command is as follows:
sysctl -w net.core.dev_weight=0
ping 127.0.0.1
This is because when the napi's weight is set to 0, process_backlog() may
return 0 and clear the NAPI_STATE_SCHED bit of napi->state, causing this
napi to be re-polled in net_rx_action() until __do_softirq() times out.
Since the NAPI_STATE_SCHED bit has been cleared, napi_schedule_rps() can
be retriggered in enqueue_to_backlog(), causing this issue.
Making the napi's weight always non-zero solves this problem.
Triggering this issue requires system-wide admin (setting is
not namespaced).
Analysis and contextual insights are available on OpenCVE Cloud.
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
| Source | ID | Title |
|---|---|---|
Debian DLA |
DLA-4102-1 | linux-6.1 security update |
Debian DLA |
DLA-4178-1 | linux security update |
EUVD |
EUVD-2025-5987 | In the Linux kernel, the following vulnerability has been resolved: net: let net.core.dev_weight always be non-zero The following problem was encountered during stability test: (NULL net_device): NAPI poll function process_backlog+0x0/0x530 \ returned 1, exceeding its budget of 0. ------------[ cut here ]------------ list_add double add: new=ffff88905f746f48, prev=ffff88905f746f48, \ next=ffff88905f746e40. WARNING: CPU: 18 PID: 5462 at lib/list_debug.c:35 \ __list_add_valid_or_report+0xf3/0x130 CPU: 18 UID: 0 PID: 5462 Comm: ping Kdump: loaded Not tainted 6.13.0-rc7+ RIP: 0010:__list_add_valid_or_report+0xf3/0x130 Call Trace: ? __warn+0xcd/0x250 ? __list_add_valid_or_report+0xf3/0x130 enqueue_to_backlog+0x923/0x1070 netif_rx_internal+0x92/0x2b0 __netif_rx+0x15/0x170 loopback_xmit+0x2ef/0x450 dev_hard_start_xmit+0x103/0x490 __dev_queue_xmit+0xeac/0x1950 ip_finish_output2+0x6cc/0x1620 ip_output+0x161/0x270 ip_push_pending_frames+0x155/0x1a0 raw_sendmsg+0xe13/0x1550 __sys_sendto+0x3bf/0x4e0 __x64_sys_sendto+0xdc/0x1b0 do_syscall_64+0x5b/0x170 entry_SYSCALL_64_after_hwframe+0x76/0x7e The reproduction command is as follows: sysctl -w net.core.dev_weight=0 ping 127.0.0.1 This is because when the napi's weight is set to 0, process_backlog() may return 0 and clear the NAPI_STATE_SCHED bit of napi->state, causing this napi to be re-polled in net_rx_action() until __do_softirq() times out. Since the NAPI_STATE_SCHED bit has been cleared, napi_schedule_rps() can be retriggered in enqueue_to_backlog(), causing this issue. Making the napi's weight always non-zero solves this problem. Triggering this issue requires system-wide admin (setting is not namespaced). |
Ubuntu USN |
USN-7510-1 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-7510-2 | Linux kernel (FIPS) vulnerabilities |
Ubuntu USN |
USN-7510-3 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-7510-4 | Linux kernel (Real-time) vulnerabilities |
Ubuntu USN |
USN-7510-5 | Linux kernel (Azure FIPS) vulnerabilities |
Ubuntu USN |
USN-7510-6 | Linux kernel (AWS FIPS) vulnerabilities |
Ubuntu USN |
USN-7510-7 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-7510-8 | Linux kernel (AWS) vulnerabilities |
Ubuntu USN |
USN-7511-1 | Linux kernel (GCP) vulnerabilities |
Ubuntu USN |
USN-7511-2 | Linux kernel (GCP FIPS) vulnerabilities |
Ubuntu USN |
USN-7511-3 | Linux kernel (GKE) vulnerabilities |
Ubuntu USN |
USN-7512-1 | Linux kernel (GCP) vulnerabilities |
Ubuntu USN |
USN-7516-1 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-7516-2 | Linux kernel (GCP FIPS) vulnerabilities |
Ubuntu USN |
USN-7516-3 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-7516-4 | Linux kernel (Oracle) vulnerabilities |
Ubuntu USN |
USN-7516-5 | Linux kernel (HWE) vulnerabilities |
Ubuntu USN |
USN-7516-6 | Linux kernel (IBM) vulnerabilities |
Ubuntu USN |
USN-7516-7 | Linux kernel (AWS) vulnerabilities |
Ubuntu USN |
USN-7516-8 | Linux kernel (FIPS) vulnerabilities |
Ubuntu USN |
USN-7516-9 | Linux kernel (AWS) vulnerabilities |
Ubuntu USN |
USN-7517-1 | Linux kernel (Xilinx ZynqMP) vulnerabilities |
Ubuntu USN |
USN-7517-2 | Linux kernel (IBM) vulnerabilities |
Ubuntu USN |
USN-7517-3 | Linux kernel (BlueField) vulnerabilities |
Ubuntu USN |
USN-7518-1 | Linux kernel (Azure FIPS) vulnerabilities |
Ubuntu USN |
USN-7521-1 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-7521-2 | Linux kernel (AWS) vulnerabilities |
Ubuntu USN |
USN-7521-3 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-7539-1 | Linux kernel (Raspberry Pi) vulnerabilities |
Ubuntu USN |
USN-7540-1 | Linux kernel (Raspberry Pi) vulnerabilities |
Ubuntu USN |
USN-7593-1 | Linux kernel (HWE) vulnerabilities |
Ubuntu USN |
USN-7602-1 | Linux kernel (Xilinx ZynqMP) vulnerabilities |
Ubuntu USN |
USN-7640-1 | Linux kernel (IoT) vulnerabilities |
Ubuntu USN |
USN-7651-1 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-7651-2 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-7651-3 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-7651-4 | Linux kernel (GCP) vulnerabilities |
Ubuntu USN |
USN-7651-5 | Linux kernel (Raspberry Pi Real-time) vulnerabilities |
Ubuntu USN |
USN-7651-6 | Linux kernel (Raspberry Pi) vulnerabilities |
Ubuntu USN |
USN-7652-1 | Linux kernel (Real-time) vulnerabilities |
Ubuntu USN |
USN-7653-1 | Linux kernel (HWE) vulnerabilities |
Ubuntu USN |
USN-7737-1 | Linux kernel (Azure) vulnerabilities |
Tue, 12 May 2026 13:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Mon, 03 Nov 2025 21:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Mon, 03 Nov 2025 20:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Tue, 28 Oct 2025 03:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Linux
Linux linux Kernel |
|
| Weaknesses | NVD-CWE-noinfo | |
| CPEs | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:2.6.12:-:*:*:*:*:*:* |
|
| Vendors & Products |
Linux
Linux linux Kernel |
|
| Metrics |
cvssV3_1
|
cvssV3_1
|
Mon, 26 May 2025 15:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-20 | |
| Metrics |
cvssV3_1
|
cvssV3_1
|
Thu, 13 Mar 2025 12:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Fri, 28 Feb 2025 14:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| References |
| |
| Metrics |
threat_severity
|
cvssV3_1
|
Thu, 27 Feb 2025 20:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | In the Linux kernel, the following vulnerability has been resolved: net: let net.core.dev_weight always be non-zero The following problem was encountered during stability test: (NULL net_device): NAPI poll function process_backlog+0x0/0x530 \ returned 1, exceeding its budget of 0. ------------[ cut here ]------------ list_add double add: new=ffff88905f746f48, prev=ffff88905f746f48, \ next=ffff88905f746e40. WARNING: CPU: 18 PID: 5462 at lib/list_debug.c:35 \ __list_add_valid_or_report+0xf3/0x130 CPU: 18 UID: 0 PID: 5462 Comm: ping Kdump: loaded Not tainted 6.13.0-rc7+ RIP: 0010:__list_add_valid_or_report+0xf3/0x130 Call Trace: ? __warn+0xcd/0x250 ? __list_add_valid_or_report+0xf3/0x130 enqueue_to_backlog+0x923/0x1070 netif_rx_internal+0x92/0x2b0 __netif_rx+0x15/0x170 loopback_xmit+0x2ef/0x450 dev_hard_start_xmit+0x103/0x490 __dev_queue_xmit+0xeac/0x1950 ip_finish_output2+0x6cc/0x1620 ip_output+0x161/0x270 ip_push_pending_frames+0x155/0x1a0 raw_sendmsg+0xe13/0x1550 __sys_sendto+0x3bf/0x4e0 __x64_sys_sendto+0xdc/0x1b0 do_syscall_64+0x5b/0x170 entry_SYSCALL_64_after_hwframe+0x76/0x7e The reproduction command is as follows: sysctl -w net.core.dev_weight=0 ping 127.0.0.1 This is because when the napi's weight is set to 0, process_backlog() may return 0 and clear the NAPI_STATE_SCHED bit of napi->state, causing this napi to be re-polled in net_rx_action() until __do_softirq() times out. Since the NAPI_STATE_SCHED bit has been cleared, napi_schedule_rps() can be retriggered in enqueue_to_backlog(), causing this issue. Making the napi's weight always non-zero solves this problem. Triggering this issue requires system-wide admin (setting is not namespaced). | |
| Title | net: let net.core.dev_weight always be non-zero | |
| References |
|
|
Status: PUBLISHED
Assigner: Linux
Published:
Updated: 2026-05-12T12:03:57.348Z
Reserved: 2024-12-29T08:45:45.771Z
Link: CVE-2025-21806
No data.
Status : Modified
Published: 2025-02-27T20:16:03.220
Modified: 2026-05-12T13:16:37.367
Link: CVE-2025-21806
OpenCVE Enrichment
No data.
Debian DLA
EUVD
Ubuntu USN