CVE-2025-38000

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-38000", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T04:51:23.976Z", "datePublished": "2025-06-06T13:03:35.405Z", "dateUpdated": "2026-10-15T21:52:06.159Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:58:51.349Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue()\n\nWhen enqueuing the first packet to an HFSC class, hfsc_enqueue() calls the\nchild qdisc's peek() operation before incrementing sch->q.qlen and\nsch->qstats.backlog. If the child qdisc uses qdisc_peek_dequeued(), this may\ntrigger an immediate dequeue and potential packet drop. In such cases,\nqdisc_tree_reduce_backlog() is called, but the HFSC qdisc's qlen and backlog\nhave not yet been updated, leading to inconsistent queue accounting. This\ncan leave an empty HFSC class in the active list, causing further\nconsequences like use-after-free.\n\nThis patch fixes the bug by moving the increment of sch->q.qlen and\nsch->qstats.backlog before the call to the child qdisc's peek() operation.\nThis ensures that queue length and backlog are always accurate when packet\ndrops or dequeues are triggered during the peek."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - Triggering requires configuring an HFSC qdisc with an RSC service curve and a peek-dequeueing child qdisc (netem/codel/fq_codel/tbf) via RTM_NEWQDISC/RTM_NEWTCLASS netlink, then transmitting a packet locally. Per kernel scoring guidance, tc/netlink qdisc configuration is a local attack vector.\nAC:L - The attacker fully controls both the qdisc hierarchy (hfsc + netem with an inner qdisc that rejects on enqueue) and the packet that drives hfsc_enqueue(), so the peek-time drop and the resulting qlen underflow are triggered deterministically with no race to win and no reliance on uncontrolled state.\nPR:L - Qdisc configuration is gated by netlink_net_capable(CAP_NET_ADMIN) against the netns owning user_ns, which any unprivileged user obtains via `unshare -Urn` and then applies to lo/dummy/veth inside the namespace. No real root in the init namespace is needed.\nUI:N - The attacker performs the qdisc setup and generates the triggering traffic entirely on their own; no victim action or interaction is required.\nS:U - The corruption is confined to kernel scheduler state in the same security authority; it is a standard local kernel privilege escalation with no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - The accounting inconsistency leaves a freed/empty hfsc_class linked in the eligible and vt-trees, and the commit explicitly states this leads to use-after-free; a UAF on a ~512-byte generic-kmalloc object with embedded rb_nodes yields a controlled read primitive over sprayed kernel objects.\nI:H - Dangling rb_node linkage of a freed hfsc_class means subsequent eltree/vttree insert, update, and rebalance operations write attacker-influenced values into reclaimed heap memory, giving a write primitive suitable for control-flow hijacking and privilege escalation.\nA:H - Even without full exploitation, the q.qlen/backlog underflow to 0xFFFFFFFF and the stale active-list entry cause use-after-free oopses, KASAN splats, and reported infinite loops in hfsc_dequeue(), crashing or hanging the machine."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/sched/sch_hfsc.c"], "versions": [{"version": "12d0ad3be9c3854e52ec74bb83bb6f43612827c7", "lessThan": "1034e3310752e8675e313f7271b348914008719a", "status": "affected", "versionType": "git"}, {"version": "12d0ad3be9c3854e52ec74bb83bb6f43612827c7", "lessThan": "f9f593e34d2fb67644372c8f7b033bdc622ad228", "status": "affected", "versionType": "git"}, {"version": "12d0ad3be9c3854e52ec74bb83bb6f43612827c7", "lessThan": "89c301e929a0db14ebd94b4d97764ce1d6981653", "status": "affected", "versionType": "git"}, {"version": "12d0ad3be9c3854e52ec74bb83bb6f43612827c7", "lessThan": "f1dde3eb17dc1b8bd07aed00004b1e05fc87a3d4", "status": "affected", "versionType": "git"}, {"version": "12d0ad3be9c3854e52ec74bb83bb6f43612827c7", "lessThan": "93c276942e75de0e5bc91576300d292e968f5a02", "status": "affected", "versionType": "git"}, {"version": "12d0ad3be9c3854e52ec74bb83bb6f43612827c7", "lessThan": "49b21795b8e5654a7df3d910a12e1060da4c04cf", "status": "affected", "versionType": "git"}, {"version": "12d0ad3be9c3854e52ec74bb83bb6f43612827c7", "lessThan": "3f3a22eebbc32b4fa8ce9c1d5f9db214b45b9335", "status": "affected", "versionType": "git"}, {"version": "12d0ad3be9c3854e52ec74bb83bb6f43612827c7", "lessThan": "3f981138109f63232a5fb7165938d4c945cc1b9d", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/sched/sch_hfsc.c"], "versions": [{"version": "4.8", "status": "affected"}, {"version": "0", "lessThan": "4.8", "status": "unaffected", "versionType": "semver"}, {"version": "5.4.294", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.238", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.185", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.141", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.93", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.31", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.14.9", "lessThanOrEqual": "6.14.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.15", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.8", "versionEndExcluding": "5.4.294"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.8", "versionEndExcluding": "5.10.238"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.8", "versionEndExcluding": "5.15.185"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.8", "versionEndExcluding": "6.1.141"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.8", "versionEndExcluding": "6.6.93"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.8", "versionEndExcluding": "6.12.31"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.8", "versionEndExcluding": "6.14.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.8", "versionEndExcluding": "6.15"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/1034e3310752e8675e313f7271b348914008719a"}, {"url": "https://git.kernel.org/stable/c/f9f593e34d2fb67644372c8f7b033bdc622ad228"}, {"url": "https://git.kernel.org/stable/c/89c301e929a0db14ebd94b4d97764ce1d6981653"}, {"url": "https://git.kernel.org/stable/c/f1dde3eb17dc1b8bd07aed00004b1e05fc87a3d4"}, {"url": "https://git.kernel.org/stable/c/93c276942e75de0e5bc91576300d292e968f5a02"}, {"url": "https://git.kernel.org/stable/c/49b21795b8e5654a7df3d910a12e1060da4c04cf"}, {"url": "https://git.kernel.org/stable/c/3f3a22eebbc32b4fa8ce9c1d5f9db214b45b9335"}, {"url": "https://git.kernel.org/stable/c/3f981138109f63232a5fb7165938d4c945cc1b9d"}], "title": "sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue()", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"}, {"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T17:32:58.709Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-38000", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:46:43.597631Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:52:06.159Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"}, {"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T17:32:58.709Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-38000", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:46:43.597631Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:46:44.383Z"}}], "cna": {"title": "sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue()", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - Triggering requires configuring an HFSC qdisc with an RSC service curve and a peek-dequeueing child qdisc (netem/codel/fq_codel/tbf) via RTM_NEWQDISC/RTM_NEWTCLASS netlink, then transmitting a packet locally. Per kernel scoring guidance, tc/netlink qdisc configuration is a local attack vector.\nAC:L - The attacker fully controls both the qdisc hierarchy (hfsc + netem with an inner qdisc that rejects on enqueue) and the packet that drives hfsc_enqueue(), so the peek-time drop and the resulting qlen underflow are triggered deterministically with no race to win and no reliance on uncontrolled state.\nPR:L - Qdisc configuration is gated by netlink_net_capable(CAP_NET_ADMIN) against the netns owning user_ns, which any unprivileged user obtains via `unshare -Urn` and then applies to lo/dummy/veth inside the namespace. No real root in the init namespace is needed.\nUI:N - The attacker performs the qdisc setup and generates the triggering traffic entirely on their own; no victim action or interaction is required.\nS:U - The corruption is confined to kernel scheduler state in the same security authority; it is a standard local kernel privilege escalation with no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - The accounting inconsistency leaves a freed/empty hfsc_class linked in the eligible and vt-trees, and the commit explicitly states this leads to use-after-free; a UAF on a ~512-byte generic-kmalloc object with embedded rb_nodes yields a controlled read primitive over sprayed kernel objects.\nI:H - Dangling rb_node linkage of a freed hfsc_class means subsequent eltree/vttree insert, update, and rebalance operations write attacker-influenced values into reclaimed heap memory, giving a write primitive suitable for control-flow hijacking and privilege escalation.\nA:H - Even without full exploitation, the q.qlen/backlog underflow to 0xFFFFFFFF and the stale active-list entry cause use-after-free oopses, KASAN splats, and reported infinite loops in hfsc_dequeue(), crashing or hanging the machine."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "12d0ad3be9c3854e52ec74bb83bb6f43612827c7", "lessThan": "1034e3310752e8675e313f7271b348914008719a", "versionType": "git"}, {"status": "affected", "version": "12d0ad3be9c3854e52ec74bb83bb6f43612827c7", "lessThan": "f9f593e34d2fb67644372c8f7b033bdc622ad228", "versionType": "git"}, {"status": "affected", "version": "12d0ad3be9c3854e52ec74bb83bb6f43612827c7", "lessThan": "89c301e929a0db14ebd94b4d97764ce1d6981653", "versionType": "git"}, {"status": "affected", "version": "12d0ad3be9c3854e52ec74bb83bb6f43612827c7", "lessThan": "f1dde3eb17dc1b8bd07aed00004b1e05fc87a3d4", "versionType": "git"}, {"status": "affected", "version": "12d0ad3be9c3854e52ec74bb83bb6f43612827c7", "lessThan": "93c276942e75de0e5bc91576300d292e968f5a02", "versionType": "git"}, {"status": "affected", "version": "12d0ad3be9c3854e52ec74bb83bb6f43612827c7", "lessThan": "49b21795b8e5654a7df3d910a12e1060da4c04cf", "versionType": "git"}, {"status": "affected", "version": "12d0ad3be9c3854e52ec74bb83bb6f43612827c7", "lessThan": "3f3a22eebbc32b4fa8ce9c1d5f9db214b45b9335", "versionType": "git"}, {"status": "affected", "version": "12d0ad3be9c3854e52ec74bb83bb6f43612827c7", "lessThan": "3f981138109f63232a5fb7165938d4c945cc1b9d", "versionType": "git"}], "programFiles": ["net/sched/sch_hfsc.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "4.8"}, {"status": "unaffected", "version": "0", "lessThan": "4.8", "versionType": "semver"}, {"status": "unaffected", "version": "5.4.294", "versionType": "semver", "lessThanOrEqual": "5.4.*"}, {"status": "unaffected", "version": "5.10.238", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.185", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.141", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.93", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.31", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.14.9", "versionType": "semver", "lessThanOrEqual": "6.14.*"}, {"status": "unaffected", "version": "6.15", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/sched/sch_hfsc.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/1034e3310752e8675e313f7271b348914008719a"}, {"url": "https://git.kernel.org/stable/c/f9f593e34d2fb67644372c8f7b033bdc622ad228"}, {"url": "https://git.kernel.org/stable/c/89c301e929a0db14ebd94b4d97764ce1d6981653"}, {"url": "https://git.kernel.org/stable/c/f1dde3eb17dc1b8bd07aed00004b1e05fc87a3d4"}, {"url": "https://git.kernel.org/stable/c/93c276942e75de0e5bc91576300d292e968f5a02"}, {"url": "https://git.kernel.org/stable/c/49b21795b8e5654a7df3d910a12e1060da4c04cf"}, {"url": "https://git.kernel.org/stable/c/3f3a22eebbc32b4fa8ce9c1d5f9db214b45b9335"}, {"url": "https://git.kernel.org/stable/c/3f981138109f63232a5fb7165938d4c945cc1b9d"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue()\n\nWhen enqueuing the first packet to an HFSC class, hfsc_enqueue() calls the\nchild qdisc's peek() operation before incrementing sch->q.qlen and\nsch->qstats.backlog. If the child qdisc uses qdisc_peek_dequeued(), this may\ntrigger an immediate dequeue and potential packet drop. In such cases,\nqdisc_tree_reduce_backlog() is called, but the HFSC qdisc's qlen and backlog\nhave not yet been updated, leading to inconsistent queue accounting. This\ncan leave an empty HFSC class in the active list, causing further\nconsequences like use-after-free.\n\nThis patch fixes the bug by moving the increment of sch->q.qlen and\nsch->qstats.backlog before the call to the child qdisc's peek() operation.\nThis ensures that queue length and backlog are always accurate when packet\ndrops or dequeues are triggered during the peek."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.4.294", "versionStartIncluding": "4.8"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.238", "versionStartIncluding": "4.8"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.185", "versionStartIncluding": "4.8"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.141", "versionStartIncluding": "4.8"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.93", "versionStartIncluding": "4.8"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.31", "versionStartIncluding": "4.8"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.14.9", "versionStartIncluding": "4.8"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.15", "versionStartIncluding": "4.8"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:58:51.349Z"}}}, "cveMetadata": {"cveId": "CVE-2025-38000", "state": "PUBLISHED", "dateUpdated": "2026-10-15T21:52:06.159Z", "dateReserved": "2025-04-16T04:51:23.976Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2025-06-06T13:03:35.405Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/sched/sch_hfsc.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "1034e3310752e8675e313f7271b348914008719a", "status": "affected", "version": "12d0ad3be9c3854e52ec74bb83bb6f43612827c7", "versionType": "git"}, {"lessThan": "f9f593e34d2fb67644372c8f7b033bdc622ad228", "status": "affected", "version": "12d0ad3be9c3854e52ec74bb83bb6f43612827c7", "versionType": "git"}, {"lessThan": "89c301e929a0db14ebd94b4d97764ce1d6981653", "status": "affected", "version": "12d0ad3be9c3854e52ec74bb83bb6f43612827c7", "versionType": "git"}, {"lessThan": "f1dde3eb17dc1b8bd07aed00004b1e05fc87a3d4", "status": "affected", "version": "12d0ad3be9c3854e52ec74bb83bb6f43612827c7", "versionType": "git"}, {"lessThan": "93c276942e75de0e5bc91576300d292e968f5a02", "status": "affected", "version": "12d0ad3be9c3854e52ec74bb83bb6f43612827c7", "versionType": "git"}, {"lessThan": "49b21795b8e5654a7df3d910a12e1060da4c04cf", "status": "affected", "version": "12d0ad3be9c3854e52ec74bb83bb6f43612827c7", "versionType": "git"}, {"lessThan": "3f3a22eebbc32b4fa8ce9c1d5f9db214b45b9335", "status": "affected", "version": "12d0ad3be9c3854e52ec74bb83bb6f43612827c7", "versionType": "git"}, {"lessThan": "3f981138109f63232a5fb7165938d4c945cc1b9d", "status": "affected", "version": "12d0ad3be9c3854e52ec74bb83bb6f43612827c7", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/sched/sch_hfsc.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.8"}, {"lessThan": "4.8", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.294", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.238", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.185", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.141", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.93", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.31", "versionType": "semver"}, {"lessThanOrEqual": "6.14.*", "status": "unaffected", "version": "6.14.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.15", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "0CABA994-09A1-4B5F-BC03-47843F28DE2A", "versionEndExcluding": "5.4.294", "versionStartIncluding": "4.8", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "0DAAEF7F-D560-47FC-8B65-20404DB82432", "versionEndExcluding": "5.10.238", "versionStartIncluding": "5.5", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "E11820B2-24BD-40A8-9E6B-5BC447252321", "versionEndExcluding": "5.15.185", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "7CEA8241-A858-4009-B4EE-31C62772811A", "versionEndExcluding": "6.1.141", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "50A4A9DE-24AB-4FB4-AACD-85D8EABB0571", "versionEndExcluding": "6.6.93", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "1AE98841-5774-4B45-A81C-2D188DB7E5C3", "versionEndExcluding": "6.12.31", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "A9B72DD1-715C-4101-A720-1C8D70044C06", "versionEndExcluding": "6.14.9", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc1:*:*:*:*:*:*", "matchCriteriaId": "8D465631-2980-487A-8E65-40AE2B9F8ED1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc2:*:*:*:*:*:*", "matchCriteriaId": "4C9D071F-B28E-46EC-AC61-22B913390211", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc3:*:*:*:*:*:*", "matchCriteriaId": "13FC0DDE-E513-465E-9E81-515702D49B74", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc4:*:*:*:*:*:*", "matchCriteriaId": "8C7B5B0E-4EEB-48F5-B4CF-0935A7633845", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc5:*:*:*:*:*:*", "matchCriteriaId": "2D240580-3048-49B2-9E27-F115A9DF8224", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc6:*:*:*:*:*:*", "matchCriteriaId": "90320558-E553-4EF5-8A0B-0F5D20113BD2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc7:*:*:*:*:*:*", "matchCriteriaId": "C300BA32-5854-4B59-A00A-18A402F291D0", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*", "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue()\n\nWhen enqueuing the first packet to an HFSC class, hfsc_enqueue() calls the\nchild qdisc's peek() operation before incrementing sch->q.qlen and\nsch->qstats.backlog. If the child qdisc uses qdisc_peek_dequeued(), this may\ntrigger an immediate dequeue and potential packet drop. In such cases,\nqdisc_tree_reduce_backlog() is called, but the HFSC qdisc's qlen and backlog\nhave not yet been updated, leading to inconsistent queue accounting. This\ncan leave an empty HFSC class in the active list, causing further\nconsequences like use-after-free.\n\nThis patch fixes the bug by moving the increment of sch->q.qlen and\nsch->qstats.backlog before the call to the child qdisc's peek() operation.\nThis ensures that queue length and backlog are always accurate when packet\ndrops or dequeues are triggered during the peek."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: sch_hfsc: Se corrige el error de contabilidad de qlen al usar peek en hfsc_enqueue(). Al encolar el primer paquete en una clase HFSC, hfsc_enqueue() llama a la operaci\u00f3n peek() de la qdisc secundaria antes de incrementar sch->q.qlen y sch->qstats.backlog. Si la qdisc secundaria usa qdisc_peek_dequeued(), esto puede desencadenar una desencola inmediata y una posible p\u00e9rdida de paquetes. En tales casos, se llama a qdisc_tree_reduce_backlog(), pero el qlen y el backlog de la qdisc HFSC a\u00fan no se han actualizado, lo que provoca una contabilidad de cola inconsistente. Esto puede dejar una clase HFSC vac\u00eda en la lista activa, lo que causa consecuencias adicionales como el use-after-free. Este parche corrige el error desplazando el incremento de sch->q.qlen y sch->qstats.backlog antes de la llamada a la operaci\u00f3n peek() de la qdisc secundaria. Esto garantiza que la longitud de la cola y el backlog sean siempre precisos cuando se activan los descartes o las desencolas de paquetes durante la inspecci\u00f3n."}], "id": "CVE-2025-38000", "lastModified": "2026-10-15T22:18:23.970", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-38000", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-15T21:46:43.597631Z", "version": "2.0.3"}}]}, "published": "2025-06-06T13:15:39.870", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/1034e3310752e8675e313f7271b348914008719a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/3f3a22eebbc32b4fa8ce9c1d5f9db214b45b9335"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/3f981138109f63232a5fb7165938d4c945cc1b9d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/49b21795b8e5654a7df3d910a12e1060da4c04cf"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/89c301e929a0db14ebd94b4d97764ce1d6981653"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/93c276942e75de0e5bc91576300d292e968f5a02"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/f1dde3eb17dc1b8bd07aed00004b1e05fc87a3d4"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/f9f593e34d2fb67644372c8f7b033bdc622ad228"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue()", "id": "2370786", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2370786"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-416", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nsch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue()\nWhen enqueuing the first packet to an HFSC class, hfsc_enqueue() calls the\nchild qdisc's peek() operation before incrementing sch->q.qlen and\nsch->qstats.backlog. If the child qdisc uses qdisc_peek_dequeued(), this may\ntrigger an immediate dequeue and potential packet drop. In such cases,\nqdisc_tree_reduce_backlog() is called, but the HFSC qdisc's qlen and backlog\nhave not yet been updated, leading to inconsistent queue accounting. This\ncan leave an empty HFSC class in the active list, causing further\nconsequences like use-after-free.\nThis patch fixes the bug by moving the increment of sch->q.qlen and\nsch->qstats.backlog before the call to the child qdisc's peek() operation.\nThis ensures that queue length and backlog are always accurate when packet\ndrops or dequeues are triggered during the peek."], "name": "CVE-2025-38000", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-06-06T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-38000\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-38000\nhttps://lore.kernel.org/linux-cve-announce/2025060639-CVE-2025-38000-f5a4@gregkh/T"], "threat_severity": "Important"}

{"created": "2025-06-24T09:51:38.932907+00:00", "updated": "2025-06-24T09:51:38.932953+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}