GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2025-38115 (GCVE-0-2025-38115)

Vulnerability from cvelistv5 – Published: 2025-07-03 08:35 – Updated: 2026-08-05 11:59
VLAI
Title
net_sched: sch_sfq: fix a potential crash on gso_skb handling
Summary
In the Linux kernel, the following vulnerability has been resolved: net_sched: sch_sfq: fix a potential crash on gso_skb handling SFQ has an assumption of always being able to queue at least one packet. However, after the blamed commit, sch->q.len can be inflated by packets in sch->gso_skb, and an enqueue() on an empty SFQ qdisc can be followed by an immediate drop. Fix sfq_drop() to properly clear q->tail in this situation. ip netns add lb ip link add dev to-lb type veth peer name in-lb netns lb ethtool -K to-lb tso off # force qdisc to requeue gso_skb ip netns exec lb ethtool -K in-lb gro on # enable NAPI ip link set dev to-lb up ip -netns lb link set dev in-lb up ip addr add dev to-lb 192.168.20.1/24 ip -netns lb addr add dev in-lb 192.168.20.2/24 tc qdisc replace dev to-lb root sfq limit 100 ip netns exec lb netserver netperf -H 192.168.20.2 -l 100 & netperf -H 192.168.20.2 -l 100 & netperf -H 192.168.20.2 -l 100 & netperf -H 192.168.20.2 -l 100 &
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: a53851e2c3218aa30b77abd6e68cf1c371f15afe , < c337efb20d6d9f9bbb4746f6b119917af5c886dc (git)
Affected: a53851e2c3218aa30b77abd6e68cf1c371f15afe , < b44f791f27b14c9eb6b907fbe51f2ba8bec32085 (git)
Affected: a53851e2c3218aa30b77abd6e68cf1c371f15afe , < 5814a7fc3abb41f63f2d44c9d3ff9d4e62965b72 (git)
Affected: a53851e2c3218aa30b77abd6e68cf1c371f15afe , < 9c19498bdd7cb9d854bd3c54260f71cf7408495e (git)
Affected: a53851e2c3218aa30b77abd6e68cf1c371f15afe , < b4e9bab6011b9559b7c157b16b91ae46d4d8c533 (git)
Affected: a53851e2c3218aa30b77abd6e68cf1c371f15afe , < d1bc80da75c789f2f6830df89d91fb2f7a509943 (git)
Affected: a53851e2c3218aa30b77abd6e68cf1c371f15afe , < 82448d4dcd8406dec688632a405fdcf7f170ec69 (git)
Affected: a53851e2c3218aa30b77abd6e68cf1c371f15afe , < 82ffbe7776d0ac084031f114167712269bf3d832 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.16
Unaffected: 0 , < 4.16 (semver)
Unaffected: 5.4.295 , ≤ 5.4.* (semver)
Unaffected: 5.10.239 , ≤ 5.10.* (semver)
Unaffected: 5.15.186 , ≤ 5.15.* (semver)
Unaffected: 6.1.142 , ≤ 6.1.* (semver)
Unaffected: 6.6.94 , ≤ 6.6.* (semver)
Unaffected: 6.12.34 , ≤ 6.12.* (semver)
Unaffected: 6.15.3 , ≤ 6.15.* (semver)
Unaffected: 6.16 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:34:18.395Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/sched/sch_sfq.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c337efb20d6d9f9bbb4746f6b119917af5c886dc",
              "status": "affected",
              "version": "a53851e2c3218aa30b77abd6e68cf1c371f15afe",
              "versionType": "git"
            },
            {
              "lessThan": "b44f791f27b14c9eb6b907fbe51f2ba8bec32085",
              "status": "affected",
              "version": "a53851e2c3218aa30b77abd6e68cf1c371f15afe",
              "versionType": "git"
            },
            {
              "lessThan": "5814a7fc3abb41f63f2d44c9d3ff9d4e62965b72",
              "status": "affected",
              "version": "a53851e2c3218aa30b77abd6e68cf1c371f15afe",
              "versionType": "git"
            },
            {
              "lessThan": "9c19498bdd7cb9d854bd3c54260f71cf7408495e",
              "status": "affected",
              "version": "a53851e2c3218aa30b77abd6e68cf1c371f15afe",
              "versionType": "git"
            },
            {
              "lessThan": "b4e9bab6011b9559b7c157b16b91ae46d4d8c533",
              "status": "affected",
              "version": "a53851e2c3218aa30b77abd6e68cf1c371f15afe",
              "versionType": "git"
            },
            {
              "lessThan": "d1bc80da75c789f2f6830df89d91fb2f7a509943",
              "status": "affected",
              "version": "a53851e2c3218aa30b77abd6e68cf1c371f15afe",
              "versionType": "git"
            },
            {
              "lessThan": "82448d4dcd8406dec688632a405fdcf7f170ec69",
              "status": "affected",
              "version": "a53851e2c3218aa30b77abd6e68cf1c371f15afe",
              "versionType": "git"
            },
            {
              "lessThan": "82ffbe7776d0ac084031f114167712269bf3d832",
              "status": "affected",
              "version": "a53851e2c3218aa30b77abd6e68cf1c371f15afe",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/sched/sch_sfq.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.16"
            },
            {
              "lessThan": "4.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.295",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.239",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.186",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.142",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.94",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.34",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.295",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.239",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.186",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.142",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.94",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.34",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.3",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet_sched: sch_sfq: fix a potential crash on gso_skb handling\n\nSFQ has an assumption of always being able to queue at least one packet.\n\nHowever, after the blamed commit, sch-\u003eq.len can be inflated by packets\nin sch-\u003egso_skb, and an enqueue() on an empty SFQ qdisc can be followed\nby an immediate drop.\n\nFix sfq_drop() to properly clear q-\u003etail in this situation.\n\n\nip netns add lb\nip link add dev to-lb type veth peer name in-lb netns lb\nethtool -K to-lb tso off                 # force qdisc to requeue gso_skb\nip netns exec lb ethtool -K in-lb gro on # enable NAPI\nip link set dev to-lb up\nip -netns lb link set dev in-lb up\nip addr add dev to-lb 192.168.20.1/24\nip -netns lb addr add dev in-lb 192.168.20.2/24\ntc qdisc replace dev to-lb root sfq limit 100\n\nip netns exec lb netserver\n\nnetperf -H 192.168.20.2 -l 100 \u0026\nnetperf -H 192.168.20.2 -l 100 \u0026\nnetperf -H 192.168.20.2 -l 100 \u0026\nnetperf -H 192.168.20.2 -l 100 \u0026"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is the SFQ qdisc, reached by configuring a qdisc via tc/netlink on a local netdevice and then driving local transmit traffic through it; there is no path for an unauthenticated remote peer to install the qdisc or control the requeue/limit conditions. Per kernel scoring convention, tc/qdisc netlink-configured subsystems are Local.\nAC:L - The attacker controls every precondition \u2014 SFQ limit, the veth/NAPI setup that forces NETDEV_TX_BUSY requeues into gso_skb, the number of flows, and the traffic rate \u2014 so the \"empty SFQ + inflated q.qlen + single-slot drop\" state is reached deterministically, as demonstrated by the upstream reproducer. No race window or uncontrollable memory layout is required.\nPR:L - Creating the veth pair and installing the SFQ qdisc requires only CAP_NET_ADMIN within a network namespace, which any unprivileged local user obtains via `unshare -Urn`; no real root in the init namespace is needed. Basic local user access is therefore sufficient.\nUI:N - The attacker sets up the qdisc and generates the traffic entirely on their own; no victim action, mount, or file open is involved.\nS:U - The corruption occurs in kernel memory and the resulting compromise stays within the same security authority (kernel/host); no VM, IOMMU, or hypervisor boundary is crossed.\nC:H - The stale q-\u003etail leads to slot-\u003eqlen underflowing to 65535, causing sfq_link() to read q-\u003edep[65535] roughly 256 KB out of bounds, and the emptied slot is returned as a fake sk_buff whose contents are read as skb-\u003elen/skb-\u003edata/GSO fields by the transmit path \u2014 both yield disclosure of adjacent kernel memory and, via heap grooming, arbitrary read.\nI:H - sfq_link() performs out-of-bounds writes (`q-\u003edep[65535].next = x` and `sfq_dep_head(q, n)-\u003eprev = x` with n taken from out-of-bounds memory), and the type-confused sfq_slot is ultimately freed into skbuff_head_cache \u2014 an OOB write plus wild free that is leverageable for control-flow hijack and privilege escalation.\nA:H - Dequeuing from the stale empty slot reliably produces a bogus sk_buff handed to the device driver plus out-of-bounds accesses, causing kernel oops/panic (the reported symptom is a crash), and the condition can be re-triggered at will."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:59:39.505Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c337efb20d6d9f9bbb4746f6b119917af5c886dc"
        },
        {
          "url": "https://git.kernel.org/stable/c/b44f791f27b14c9eb6b907fbe51f2ba8bec32085"
        },
        {
          "url": "https://git.kernel.org/stable/c/5814a7fc3abb41f63f2d44c9d3ff9d4e62965b72"
        },
        {
          "url": "https://git.kernel.org/stable/c/9c19498bdd7cb9d854bd3c54260f71cf7408495e"
        },
        {
          "url": "https://git.kernel.org/stable/c/b4e9bab6011b9559b7c157b16b91ae46d4d8c533"
        },
        {
          "url": "https://git.kernel.org/stable/c/d1bc80da75c789f2f6830df89d91fb2f7a509943"
        },
        {
          "url": "https://git.kernel.org/stable/c/82448d4dcd8406dec688632a405fdcf7f170ec69"
        },
        {
          "url": "https://git.kernel.org/stable/c/82ffbe7776d0ac084031f114167712269bf3d832"
        }
      ],
      "title": "net_sched: sch_sfq: fix a potential crash on gso_skb handling",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38115",
    "datePublished": "2025-07-03T08:35:23.750Z",
    "dateReserved": "2025-04-16T04:51:23.986Z",
    "dateUpdated": "2026-08-05T11:59:39.505Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-38115",
      "date": "2026-09-16",
      "epss": "0.00192",
      "percentile": "0.09088"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-18T01:49:30.000Z",
      "cve": "CVE-2025-38115",
      "id": "msrc_CVE-2025-38115",
      "initial_release_date": "2025-07-02T00:00:00.000Z",
      "product_status:fixed": "2",
      "product_status:known_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "net_sched: sch_sfq: fix a potential crash on gso_skb handling",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-38115.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-38115\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-07-03T09:15:25.350\",\"lastModified\":\"2026-07-30T06:22:52.100\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet_sched: sch_sfq: fix a potential crash on gso_skb handling\\n\\nSFQ has an assumption of always being able to queue at least one packet.\\n\\nHowever, after the blamed commit, sch-\u003eq.len can be inflated by packets\\nin sch-\u003egso_skb, and an enqueue() on an empty SFQ qdisc can be followed\\nby an immediate drop.\\n\\nFix sfq_drop() to properly clear q-\u003etail in this situation.\\n\\n\\nip netns add lb\\nip link add dev to-lb type veth peer name in-lb netns lb\\nethtool -K to-lb tso off                 # force qdisc to requeue gso_skb\\nip netns exec lb ethtool -K in-lb gro on # enable NAPI\\nip link set dev to-lb up\\nip -netns lb link set dev in-lb up\\nip addr add dev to-lb 192.168.20.1/24\\nip -netns lb addr add dev in-lb 192.168.20.2/24\\ntc qdisc replace dev to-lb root sfq limit 100\\n\\nip netns exec lb netserver\\n\\nnetperf -H 192.168.20.2 -l 100 \u0026\\nnetperf -H 192.168.20.2 -l 100 \u0026\\nnetperf -H 192.168.20.2 -l 100 \u0026\\nnetperf -H 192.168.20.2 -l 100 \u0026\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net_sched: sch_sfq: se corrige un posible fallo en la gesti\u00f3n de gso_skb. SFQ asume que siempre puede poner en cola al menos un paquete. Sin embargo, tras la confirmaci\u00f3n responsable, sch-\u0026gt;q.len puede inflarse con paquetes en sch-\u0026gt;gso_skb, y una operaci\u00f3n enqueue() en una qdisc SFQ vac\u00eda puede ir seguida de un descarte inmediato. Corrija sfq_drop() para que borre correctamente q-\u0026gt;tail en esta situaci\u00f3n. ip netns add lb ip link add dev to-lb type veth peer name in-lb netns lb ethtool -K to-lb tso off # force qdisc to requeue gso_skb ip netns exec lb ethtool -K in-lb gro on # enable NAPI ip link set dev to-lb up ip -netns lb link set dev in-lb up ip addr add dev to-lb 192.168.20.1/24 ip -netns lb addr add dev in-lb 192.168.20.2/24 tc qdisc replace dev to-lb root sfq limit 100 ip netns exec lb netserver netperf -H 192.168.20.2 -l 100 \u0026amp; netperf -H 192.168.20.2 -l 100 \u0026amp; netperf -H 192.168.20.2 -l 100 \u0026amp; netperf -H 192.168.20.2 -l 100 \u0026amp; \"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/sched/sch_sfq.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"a53851e2c3218aa30b77abd6e68cf1c371f15afe\",\"lessThan\":\"c337efb20d6d9f9bbb4746f6b119917af5c886dc\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a53851e2c3218aa30b77abd6e68cf1c371f15afe\",\"lessThan\":\"b44f791f27b14c9eb6b907fbe51f2ba8bec32085\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a53851e2c3218aa30b77abd6e68cf1c371f15afe\",\"lessThan\":\"5814a7fc3abb41f63f2d44c9d3ff9d4e62965b72\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a53851e2c3218aa30b77abd6e68cf1c371f15afe\",\"lessThan\":\"9c19498bdd7cb9d854bd3c54260f71cf7408495e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a53851e2c3218aa30b77abd6e68cf1c371f15afe\",\"lessThan\":\"b4e9bab6011b9559b7c157b16b91ae46d4d8c533\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a53851e2c3218aa30b77abd6e68cf1c371f15afe\",\"lessThan\":\"d1bc80da75c789f2f6830df89d91fb2f7a509943\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a53851e2c3218aa30b77abd6e68cf1c371f15afe\",\"lessThan\":\"82448d4dcd8406dec688632a405fdcf7f170ec69\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a53851e2c3218aa30b77abd6e68cf1c371f15afe\",\"lessThan\":\"82ffbe7776d0ac084031f114167712269bf3d832\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/sched/sch_sfq.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.16\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.16\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.295\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.239\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.186\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.142\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.94\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.34\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.15.3\",\"lessThanOrEqual\":\"6.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.16\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-401\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.16\",\"versionEndExcluding\":\"5.4.295\",\"matchCriteriaId\":\"C32D9D17-384D-4914-8E02-A7F29752ABAB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.239\",\"matchCriteriaId\":\"C3D14F4C-A21E-465D-A928-5CCE684E2B98\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.186\",\"matchCriteriaId\":\"D96F2C0D-0D4A-4658-AD34-D8A626EA422D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.142\",\"matchCriteriaId\":\"459B4E94-FE0E-434D-B782-95E3A5FFC6B1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.94\",\"matchCriteriaId\":\"304E3F01-7D7A-4908-994E-7F95C5C00B06\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.34\",\"matchCriteriaId\":\"4FFA54AA-CDFE-4591-BD07-72813D0948F4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.15.3\",\"matchCriteriaId\":\"0541C761-BD5E-4C1A-8432-83B375D7EB92\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"6D4894DB-CCFE-4602-B1BF-3960B2E19A01\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FA6FEEC2-9F11-4643-8827-749718254FED\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/5814a7fc3abb41f63f2d44c9d3ff9d4e62965b72\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/82448d4dcd8406dec688632a405fdcf7f170ec69\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/82ffbe7776d0ac084031f114167712269bf3d832\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9c19498bdd7cb9d854bd3c54260f71cf7408495e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b44f791f27b14c9eb6b907fbe51f2ba8bec32085\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b4e9bab6011b9559b7c157b16b91ae46d4d8c533\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c337efb20d6d9f9bbb4746f6b119917af5c886dc\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d1bc80da75c789f2f6830df89d91fb2f7a509943\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-30T09:18:18+00:00",
      "cve": "CVE-2025-38115",
      "id": "CVE-2025-38115",
      "initial_release_date": "2025-07-03T00:00:00+00:00",
      "product_status:known_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Linux kernel: Local Denial of Service in network scheduler",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-38115.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-28T17:02:40Z",
      "cve": "CVE-2025-38115",
      "id": "CVE-2025-38115",
      "initial_release_date": "2025-07-03T23:23:39Z",
      "product_status:known_affected": "686",
      "product_status:known_not_affected": "96",
      "product_status:recommended": "419",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-38115",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-38115.json",
      "version": "29"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.