CVE-2025-38000 (GCVE-0-2025-38000)

Vulnerability from cvelistv5 – Published: 2025-06-06 13:03 – Updated: 2026-08-05 11:58
VLAI
Title
sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue()
Summary
In the Linux kernel, the following vulnerability has been resolved: sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() When enqueuing the first packet to an HFSC class, hfsc_enqueue() calls the child qdisc's peek() operation before incrementing sch->q.qlen and sch->qstats.backlog. If the child qdisc uses qdisc_peek_dequeued(), this may trigger an immediate dequeue and potential packet drop. In such cases, qdisc_tree_reduce_backlog() is called, but the HFSC qdisc's qlen and backlog have not yet been updated, leading to inconsistent queue accounting. This can leave an empty HFSC class in the active list, causing further consequences like use-after-free. This patch fixes the bug by moving the increment of sch->q.qlen and sch->qstats.backlog before the call to the child qdisc's peek() operation. This ensures that queue length and backlog are always accurate when packet drops or dequeues are triggered during the peek.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 12d0ad3be9c3854e52ec74bb83bb6f43612827c7 , < 1034e3310752e8675e313f7271b348914008719a (git)
Affected: 12d0ad3be9c3854e52ec74bb83bb6f43612827c7 , < f9f593e34d2fb67644372c8f7b033bdc622ad228 (git)
Affected: 12d0ad3be9c3854e52ec74bb83bb6f43612827c7 , < 89c301e929a0db14ebd94b4d97764ce1d6981653 (git)
Affected: 12d0ad3be9c3854e52ec74bb83bb6f43612827c7 , < f1dde3eb17dc1b8bd07aed00004b1e05fc87a3d4 (git)
Affected: 12d0ad3be9c3854e52ec74bb83bb6f43612827c7 , < 93c276942e75de0e5bc91576300d292e968f5a02 (git)
Affected: 12d0ad3be9c3854e52ec74bb83bb6f43612827c7 , < 49b21795b8e5654a7df3d910a12e1060da4c04cf (git)
Affected: 12d0ad3be9c3854e52ec74bb83bb6f43612827c7 , < 3f3a22eebbc32b4fa8ce9c1d5f9db214b45b9335 (git)
Affected: 12d0ad3be9c3854e52ec74bb83bb6f43612827c7 , < 3f981138109f63232a5fb7165938d4c945cc1b9d (git)
Create a notification for this product.
Linux Linux Affected: 4.8
Unaffected: 0 , < 4.8 (semver)
Unaffected: 5.4.294 , ≤ 5.4.* (semver)
Unaffected: 5.10.238 , ≤ 5.10.* (semver)
Unaffected: 5.15.185 , ≤ 5.15.* (semver)
Unaffected: 6.1.141 , ≤ 6.1.* (semver)
Unaffected: 6.6.93 , ≤ 6.6.* (semver)
Unaffected: 6.12.31 , ≤ 6.12.* (semver)
Unaffected: 6.14.9 , ≤ 6.14.* (semver)
Unaffected: 6.15 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:32:58.709Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/sched/sch_hfsc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "1034e3310752e8675e313f7271b348914008719a",
              "status": "affected",
              "version": "12d0ad3be9c3854e52ec74bb83bb6f43612827c7",
              "versionType": "git"
            },
            {
              "lessThan": "f9f593e34d2fb67644372c8f7b033bdc622ad228",
              "status": "affected",
              "version": "12d0ad3be9c3854e52ec74bb83bb6f43612827c7",
              "versionType": "git"
            },
            {
              "lessThan": "89c301e929a0db14ebd94b4d97764ce1d6981653",
              "status": "affected",
              "version": "12d0ad3be9c3854e52ec74bb83bb6f43612827c7",
              "versionType": "git"
            },
            {
              "lessThan": "f1dde3eb17dc1b8bd07aed00004b1e05fc87a3d4",
              "status": "affected",
              "version": "12d0ad3be9c3854e52ec74bb83bb6f43612827c7",
              "versionType": "git"
            },
            {
              "lessThan": "93c276942e75de0e5bc91576300d292e968f5a02",
              "status": "affected",
              "version": "12d0ad3be9c3854e52ec74bb83bb6f43612827c7",
              "versionType": "git"
            },
            {
              "lessThan": "49b21795b8e5654a7df3d910a12e1060da4c04cf",
              "status": "affected",
              "version": "12d0ad3be9c3854e52ec74bb83bb6f43612827c7",
              "versionType": "git"
            },
            {
              "lessThan": "3f3a22eebbc32b4fa8ce9c1d5f9db214b45b9335",
              "status": "affected",
              "version": "12d0ad3be9c3854e52ec74bb83bb6f43612827c7",
              "versionType": "git"
            },
            {
              "lessThan": "3f981138109f63232a5fb7165938d4c945cc1b9d",
              "status": "affected",
              "version": "12d0ad3be9c3854e52ec74bb83bb6f43612827c7",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/sched/sch_hfsc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.8"
            },
            {
              "lessThan": "4.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.294",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.238",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.185",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.141",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.93",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.31",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.14.*",
              "status": "unaffected",
              "version": "6.14.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.15",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.294",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.238",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.185",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.141",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.93",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.31",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14.9",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue()\n\nWhen enqueuing the first packet to an HFSC class, hfsc_enqueue() calls the\nchild qdisc\u0027s peek() operation before incrementing sch-\u003eq.qlen and\nsch-\u003eqstats.backlog. If the child qdisc uses qdisc_peek_dequeued(), this may\ntrigger an immediate dequeue and potential packet drop. In such cases,\nqdisc_tree_reduce_backlog() is called, but the HFSC qdisc\u0027s qlen and backlog\nhave not yet been updated, leading to inconsistent queue accounting. This\ncan leave an empty HFSC class in the active list, causing further\nconsequences like use-after-free.\n\nThis patch fixes the bug by moving the increment of sch-\u003eq.qlen and\nsch-\u003eqstats.backlog before the call to the child qdisc\u0027s peek() operation.\nThis ensures that queue length and backlog are always accurate when packet\ndrops or dequeues are triggered during the peek."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Triggering requires configuring an HFSC qdisc with an RSC service curve and a peek-dequeueing child qdisc (netem/codel/fq_codel/tbf) via RTM_NEWQDISC/RTM_NEWTCLASS netlink, then transmitting a packet locally. Per kernel scoring guidance, tc/netlink qdisc configuration is a local attack vector.\nAC:L - The attacker fully controls both the qdisc hierarchy (hfsc + netem with an inner qdisc that rejects on enqueue) and the packet that drives hfsc_enqueue(), so the peek-time drop and the resulting qlen underflow are triggered deterministically with no race to win and no reliance on uncontrolled state.\nPR:L - Qdisc configuration is gated by netlink_net_capable(CAP_NET_ADMIN) against the netns owning user_ns, which any unprivileged user obtains via `unshare -Urn` and then applies to lo/dummy/veth inside the namespace. No real root in the init namespace is needed.\nUI:N - The attacker performs the qdisc setup and generates the triggering traffic entirely on their own; no victim action or interaction is required.\nS:U - The corruption is confined to kernel scheduler state in the same security authority; it is a standard local kernel privilege escalation with no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - The accounting inconsistency leaves a freed/empty hfsc_class linked in the eligible and vt-trees, and the commit explicitly states this leads to use-after-free; a UAF on a ~512-byte generic-kmalloc object with embedded rb_nodes yields a controlled read primitive over sprayed kernel objects.\nI:H - Dangling rb_node linkage of a freed hfsc_class means subsequent eltree/vttree insert, update, and rebalance operations write attacker-influenced values into reclaimed heap memory, giving a write primitive suitable for control-flow hijacking and privilege escalation.\nA:H - Even without full exploitation, the q.qlen/backlog underflow to 0xFFFFFFFF and the stale active-list entry cause use-after-free oopses, KASAN splats, and reported infinite loops in hfsc_dequeue(), crashing or hanging the machine."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:58:51.349Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/1034e3310752e8675e313f7271b348914008719a"
        },
        {
          "url": "https://git.kernel.org/stable/c/f9f593e34d2fb67644372c8f7b033bdc622ad228"
        },
        {
          "url": "https://git.kernel.org/stable/c/89c301e929a0db14ebd94b4d97764ce1d6981653"
        },
        {
          "url": "https://git.kernel.org/stable/c/f1dde3eb17dc1b8bd07aed00004b1e05fc87a3d4"
        },
        {
          "url": "https://git.kernel.org/stable/c/93c276942e75de0e5bc91576300d292e968f5a02"
        },
        {
          "url": "https://git.kernel.org/stable/c/49b21795b8e5654a7df3d910a12e1060da4c04cf"
        },
        {
          "url": "https://git.kernel.org/stable/c/3f3a22eebbc32b4fa8ce9c1d5f9db214b45b9335"
        },
        {
          "url": "https://git.kernel.org/stable/c/3f981138109f63232a5fb7165938d4c945cc1b9d"
        }
      ],
      "title": "sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38000",
    "datePublished": "2025-06-06T13:03:35.405Z",
    "dateReserved": "2025-04-16T04:51:23.976Z",
    "dateUpdated": "2026-08-05T11:58:51.349Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-38000",
      "date": "2026-08-05",
      "epss": "0.00179",
      "percentile": "0.0765"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-38000\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-06-06T13:15:39.870\",\"lastModified\":\"2026-07-30T06:22:43.420\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nsch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue()\\n\\nWhen enqueuing the first packet to an HFSC class, hfsc_enqueue() calls the\\nchild qdisc\u0027s peek() operation before incrementing sch-\u003eq.qlen and\\nsch-\u003eqstats.backlog. If the child qdisc uses qdisc_peek_dequeued(), this may\\ntrigger an immediate dequeue and potential packet drop. In such cases,\\nqdisc_tree_reduce_backlog() is called, but the HFSC qdisc\u0027s qlen and backlog\\nhave not yet been updated, leading to inconsistent queue accounting. This\\ncan leave an empty HFSC class in the active list, causing further\\nconsequences like use-after-free.\\n\\nThis patch fixes the bug by moving the increment of sch-\u003eq.qlen and\\nsch-\u003eqstats.backlog before the call to the child qdisc\u0027s peek() operation.\\nThis ensures that queue length and backlog are always accurate when packet\\ndrops or dequeues are triggered during the peek.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: sch_hfsc: Se corrige el error de contabilidad de qlen al usar peek en hfsc_enqueue(). Al encolar el primer paquete en una clase HFSC, hfsc_enqueue() llama a la operaci\u00f3n peek() de la qdisc secundaria antes de incrementar sch-\u0026gt;q.qlen y sch-\u0026gt;qstats.backlog. Si la qdisc secundaria usa qdisc_peek_dequeued(), esto puede desencadenar una desencola inmediata y una posible p\u00e9rdida de paquetes. En tales casos, se llama a qdisc_tree_reduce_backlog(), pero el qlen y el backlog de la qdisc HFSC a\u00fan no se han actualizado, lo que provoca una contabilidad de cola inconsistente. Esto puede dejar una clase HFSC vac\u00eda en la lista activa, lo que causa consecuencias adicionales como el use-after-free. Este parche corrige el error desplazando el incremento de sch-\u0026gt;q.qlen y sch-\u0026gt;qstats.backlog antes de la llamada a la operaci\u00f3n peek() de la qdisc secundaria. Esto garantiza que la longitud de la cola y el backlog sean siempre precisos cuando se activan los descartes o las desencolas de paquetes durante la inspecci\u00f3n.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/sched/sch_hfsc.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"12d0ad3be9c3854e52ec74bb83bb6f43612827c7\",\"lessThan\":\"1034e3310752e8675e313f7271b348914008719a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"12d0ad3be9c3854e52ec74bb83bb6f43612827c7\",\"lessThan\":\"f9f593e34d2fb67644372c8f7b033bdc622ad228\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"12d0ad3be9c3854e52ec74bb83bb6f43612827c7\",\"lessThan\":\"89c301e929a0db14ebd94b4d97764ce1d6981653\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"12d0ad3be9c3854e52ec74bb83bb6f43612827c7\",\"lessThan\":\"f1dde3eb17dc1b8bd07aed00004b1e05fc87a3d4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"12d0ad3be9c3854e52ec74bb83bb6f43612827c7\",\"lessThan\":\"93c276942e75de0e5bc91576300d292e968f5a02\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"12d0ad3be9c3854e52ec74bb83bb6f43612827c7\",\"lessThan\":\"49b21795b8e5654a7df3d910a12e1060da4c04cf\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"12d0ad3be9c3854e52ec74bb83bb6f43612827c7\",\"lessThan\":\"3f3a22eebbc32b4fa8ce9c1d5f9db214b45b9335\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"12d0ad3be9c3854e52ec74bb83bb6f43612827c7\",\"lessThan\":\"3f981138109f63232a5fb7165938d4c945cc1b9d\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/sched/sch_hfsc.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.8\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.8\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.294\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.238\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.185\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.141\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.93\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.31\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.14.9\",\"lessThanOrEqual\":\"6.14.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.15\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.8\",\"versionEndExcluding\":\"5.4.294\",\"matchCriteriaId\":\"0CABA994-09A1-4B5F-BC03-47843F28DE2A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.238\",\"matchCriteriaId\":\"0DAAEF7F-D560-47FC-8B65-20404DB82432\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.185\",\"matchCriteriaId\":\"E11820B2-24BD-40A8-9E6B-5BC447252321\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.141\",\"matchCriteriaId\":\"7CEA8241-A858-4009-B4EE-31C62772811A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.93\",\"matchCriteriaId\":\"50A4A9DE-24AB-4FB4-AACD-85D8EABB0571\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.31\",\"matchCriteriaId\":\"1AE98841-5774-4B45-A81C-2D188DB7E5C3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.14.9\",\"matchCriteriaId\":\"A9B72DD1-715C-4101-A720-1C8D70044C06\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.15:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"8D465631-2980-487A-8E65-40AE2B9F8ED1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.15:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"4C9D071F-B28E-46EC-AC61-22B913390211\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.15:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"13FC0DDE-E513-465E-9E81-515702D49B74\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.15:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"8C7B5B0E-4EEB-48F5-B4CF-0935A7633845\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.15:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"2D240580-3048-49B2-9E27-F115A9DF8224\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.15:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"90320558-E553-4EF5-8A0B-0F5D20113BD2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.15:rc7:*:*:*:*:*:*\",\"matchCriteriaId\":\"C300BA32-5854-4B59-A00A-18A402F291D0\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FA6FEEC2-9F11-4643-8827-749718254FED\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/1034e3310752e8675e313f7271b348914008719a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3f3a22eebbc32b4fa8ce9c1d5f9db214b45b9335\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3f981138109f63232a5fb7165938d4c945cc1b9d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/49b21795b8e5654a7df3d910a12e1060da4c04cf\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/89c301e929a0db14ebd94b4d97764ce1d6981653\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/93c276942e75de0e5bc91576300d292e968f5a02\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f1dde3eb17dc1b8bd07aed00004b1e05fc87a3d4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f9f593e34d2fb67644372c8f7b033bdc622ad228\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-07-30T08:56:39+00:00",
      "cve": "CVE-2025-38000",
      "id": "CVE-2025-38000",
      "initial_release_date": "2025-06-06T00:00:00+00:00",
      "product_status:fixed": "1218",
      "product_status:known_affected": "160",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-38000.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-07-25T00:53:09Z",
      "cve": "CVE-2025-38000",
      "id": "CVE-2025-38000",
      "initial_release_date": "2025-06-10T02:08:10Z",
      "product_status:known_affected": "477",
      "product_status:known_not_affected": "22",
      "product_status:recommended": "867",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-38000",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-38000.json",
      "version": "58"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.