https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 22:53:44 +0000 https://vulnerability.circl.lu/vuln/cve-2025-38350 <p><strong>Affected:</strong> Linux, Siemens RUGGEDCOM RST2428P, Siemens SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family, Siemens SCALANCE XCH328, Siemens SCALANCE XCM324, Siemens SCALANCE XCM328, Siemens SCALANCE XCM332, Siemens SCALANCE XRH334 (24 V DC, 8xFO, CC), Siemens SCALANCE XRM334 (230 V AC, 12xFO), Siemens SCALANCE XRM334 (230 V AC, 8xFO) and 10 more</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>net/sched: Always pass notifications when child class becomes empty</p> <p>Certain classful qdiscs may invoke their classes&#39; dequeue handler on an enqueue operation. This may unexpectedly empty the child qdisc and thus make an in-flight class passive via qlen_notify(). Most qdiscs do not expect such behaviour at this point in time and may re-activate the class eventually anyways which will lead to a use-after-free.</p> <p>The referenced fix commit attempted to fix this behavior for the HFSC case by moving the backlog accounting around, though this turned out to be incomplete since the parent&#39;s parent may run into the issue too. The following reproducer demonstrates this use-after-free:</p> <p>tc qdisc add dev lo root handle 1: drr tc filter add dev lo parent 1: basic classid 1:1 tc class add dev lo parent 1: classid 1:1 drr tc qdisc add dev lo parent 1:1 handle 2: hfsc def 1 tc class add dev lo parent 2: classid 2:1 hfsc rt m1 8 d 1 m2 0 tc qdisc add dev lo parent 2:1 handle 3: netem tc qdisc add dev lo parent 3:1 handle 4: blackhole</p> <p>echo 1 | socat -u STDIN UDP4-DATAGRAM:127.0.0.1:8888 tc class delete dev lo classid 1:1 echo 1 | socat -u STDIN UDP4-DATAGRAM:127.0.0.1:8888</p> <p>Since backlog accounting issues leading to a use-after-frees on stale class pointers is a recurring pattern at this point, this patch takes a different approach. Instead of trying to fix the accounting, the patch en…</p> <p><strong>Affected:</strong> Linux, Siemens RUGGEDCOM RST2428P, Siemens SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family, Siemens SCALANCE XCH328, Siemens SCALANCE XCM324, Siemens SCALANCE XCM328, Siemens SCALANCE XCM332, Siemens SCALANCE XRH334 (24 V DC, 8xFO, CC), Siemens SCALANCE XRM334 (230 V AC, 12xFO), Siemens SCALANCE XRM334 (230 V AC, 8xFO) and 10 more</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>net/sched: Always pass notifications when child class becomes empty</p> <p>Certain classful qdiscs may invoke their classes&#39; dequeue handler on an enqueue operation. This may unexpectedly empty the child qdisc and thus make an in-flight class passive via qlen_notify(). Most qdiscs do not expect such behaviour at this point in time and may re-activate the class eventually anyways which will lead to a use-after-free.</p> <p>The referenced fix commit attempted to fix this behavior for the HFSC case by moving the backlog accounting around, though this turned out to be incomplete since the parent&#39;s parent may run into the issue too. The following reproducer demonstrates this use-after-free:</p> <p>tc qdisc add dev lo root handle 1: drr tc filter add dev lo parent 1: basic classid 1:1 tc class add dev lo parent 1: classid 1:1 drr tc qdisc add dev lo parent 1:1 handle 2: hfsc def 1 tc class add dev lo parent 2: classid 2:1 hfsc rt m1 8 d 1 m2 0 tc qdisc add dev lo parent 2:1 handle 3: netem tc qdisc add dev lo parent 3:1 handle 4: blackhole</p> <p>echo 1 | socat -u STDIN UDP4-DATAGRAM:127.0.0.1:8888 tc class delete dev lo classid 1:1 echo 1 | socat -u STDIN UDP4-DATAGRAM:127.0.0.1:8888</p> <p>Since backlog accounting issues leading to a use-after-frees on stale class pointers is a recurring pattern at this point, this patch takes a different approach. Instead of trying to fix the accounting, the patch en…</p> https://vulnerability.circl.lu/vuln/cve-2025-38350 https://vulnerability.circl.lu/vuln/usn-7722-1 <p><strong>Affected:</strong> Ubuntu:24.04:LTS: linux-aws-6.14, Ubuntu:24.04:LTS: linux-hwe-6.14, Ubuntu:Pro:Realtime:24.04:LTS: linux-realtime-6.14</p> <p>A security issues was discovered in the Linux kernel. An attacker could possibly use this to compromise the system. This update corrects flaws in the following subsystem: - Network traffic control; (CVE-2025-38350)</p> <p><strong>Affected:</strong> Ubuntu:24.04:LTS: linux-aws-6.14, Ubuntu:24.04:LTS: linux-hwe-6.14, Ubuntu:Pro:Realtime:24.04:LTS: linux-realtime-6.14</p> <p>A security issues was discovered in the Linux kernel. An attacker could possibly use this to compromise the system. This update corrects flaws in the following subsystem: - Network traffic control; (CVE-2025-38350)</p> https://vulnerability.circl.lu/vuln/usn-7722-1