CVE-2025-38000

HIGH EPSS 7.7%

Published Jun 6, 20251y ago · Modified Jun 17, 20261w ago

7.8 CVSS 3.1

High

Published Jun 6, 2025 1y ago

Last Modified Jun 17, 2026 1w ago

Description

In the Linux kernel, the following vulnerability has been resolved: sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() When enqueuing the first packet to an HFSC class, hfsc_enqueue() calls the child qdisc's peek() operation before incrementing sch->q.qlen and sch->qstats.backlog. If the child qdisc uses qdisc_peek_dequeued(), this may trigger an immediate dequeue and potential packet drop. In such cases, qdisc_tree_reduce_backlog() is called, but the HFSC qdisc's qlen and backlog have not yet been updated, leading to inconsistent queue accounting. This can leave an empty HFSC class in the active list, causing further consequences like use-after-free. This patch fixes the bug by moving the increment of sch->q.qlen and sch->qstats.backlog before the call to the child qdisc's peek() operation. This ensures that queue length and backlog are always accurate when packet drops or dequeues are triggered during the peek.

CVSS Details

Base Score

7.8

Exploitability

1.8

Impact

5.9

Vector string

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector Local

Attack Complexity Low

Privileges Required Low

User Interaction None

Scope Unchanged

Confidentiality High

Integrity High

Availability High

Threat Intelligence

EPSS Exploit Probability

7.7% percentile

Exploit & Patch Status

No Known Exploit

Patch Available

Weaknesses 1

CWE-416 Use After Free Memory Safety

Affected Products 15

Vendor	Product	Version	Range
linux	linux_kernel	*	≥4.8 – <5.4.294
linux	linux_kernel	*	≥5.5 – <5.10.238
linux	linux_kernel	*	≥5.11 – <5.15.185
linux	linux_kernel	*	≥5.16 – <6.1.141
linux	linux_kernel	*	≥6.2 – <6.6.93
linux	linux_kernel	*	≥6.7 – <6.12.31
linux	linux_kernel	*	≥6.13 – <6.14.9
linux	linux_kernel	6.15	any
linux	linux_kernel	6.15	any
linux	linux_kernel	6.15	any
linux	linux_kernel	6.15	any
linux	linux_kernel	6.15	any
linux	linux_kernel	6.15	any
linux	linux_kernel	6.15	any
debian	debian_linux	11.0	any

References 10

git.kernel.org https://git.kernel.org/stable/c/1034e3310752e8675e313f7271b348914008719a

Patch
git.kernel.org https://git.kernel.org/stable/c/3f3a22eebbc32b4fa8ce9c1d5f9db214b45b9335

Patch
git.kernel.org https://git.kernel.org/stable/c/3f981138109f63232a5fb7165938d4c945cc1b9d

Patch
git.kernel.org https://git.kernel.org/stable/c/49b21795b8e5654a7df3d910a12e1060da4c04cf

Patch
git.kernel.org https://git.kernel.org/stable/c/89c301e929a0db14ebd94b4d97764ce1d6981653

Patch
git.kernel.org https://git.kernel.org/stable/c/93c276942e75de0e5bc91576300d292e968f5a02

Patch
git.kernel.org https://git.kernel.org/stable/c/f1dde3eb17dc1b8bd07aed00004b1e05fc87a3d4

Patch
git.kernel.org https://git.kernel.org/stable/c/f9f593e34d2fb67644372c8f7b033bdc622ad228

Patch
lists.debian.org https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html

Third Party Advisory
lists.debian.org https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html

Third Party Advisory

Remediation

git.kernel.org https://git.kernel.org/stable/c/1034e3310752e8675e313f7271b348914008719a

Patch
git.kernel.org https://git.kernel.org/stable/c/3f3a22eebbc32b4fa8ce9c1d5f9db214b45b9335

Patch
git.kernel.org https://git.kernel.org/stable/c/3f981138109f63232a5fb7165938d4c945cc1b9d

Patch
git.kernel.org https://git.kernel.org/stable/c/49b21795b8e5654a7df3d910a12e1060da4c04cf

Patch
git.kernel.org https://git.kernel.org/stable/c/89c301e929a0db14ebd94b4d97764ce1d6981653

Patch
git.kernel.org https://git.kernel.org/stable/c/93c276942e75de0e5bc91576300d292e968f5a02

Patch
git.kernel.org https://git.kernel.org/stable/c/f1dde3eb17dc1b8bd07aed00004b1e05fc87a3d4

Patch
git.kernel.org https://git.kernel.org/stable/c/f9f593e34d2fb67644372c8f7b033bdc622ad228

Patch