CVE-2025-38278 (GCVE-0-2025-38278)

Vulnerability from cvelistv5 – Published: 2025-07-10 07:41 – Updated: 2026-08-05 12:00
VLAI
Title
octeontx2-pf: QOS: Refactor TC_HTB_LEAF_DEL_LAST callback
Summary
In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: QOS: Refactor TC_HTB_LEAF_DEL_LAST callback This patch addresses below issues, 1. Active traffic on the leaf node must be stopped before its send queue is reassigned to the parent. This patch resolves the issue by marking the node as 'Inner'. 2. During a system reboot, the interface receives TC_HTB_LEAF_DEL and TC_HTB_LEAF_DEL_LAST callbacks to delete its HTB queues. In the case of TC_HTB_LEAF_DEL_LAST, although the same send queue is reassigned to the parent, the current logic still attempts to update the real number of queues, leadning to below warnings New queues can't be registered after device unregistration. WARNING: CPU: 0 PID: 6475 at net/core/net-sysfs.c:1714 netdev_queue_update_kobjects+0x1e4/0x200
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 5e6808b4c68d7882971514ab3279926eb07c8b2d , < 5df8db01d6a4e9c35a5ba5d7e130d5cecd3ffcb4 (git)
Affected: 5e6808b4c68d7882971514ab3279926eb07c8b2d , < ec62c99914a79d84c8de5ba1b94d62f2ed721f2a (git)
Affected: 5e6808b4c68d7882971514ab3279926eb07c8b2d , < f1fca0eae5a0573f226f46c6871260278e7dda12 (git)
Affected: 5e6808b4c68d7882971514ab3279926eb07c8b2d , < 67af4ec948e8ce3ea53a9cf614d01fddf172e56d (git)
Create a notification for this product.
Linux Linux Affected: 6.5
Unaffected: 0 , < 6.5 (semver)
Unaffected: 6.6.94 , ≤ 6.6.* (semver)
Unaffected: 6.12.34 , ≤ 6.12.* (semver)
Unaffected: 6.15.3 , ≤ 6.15.* (semver)
Unaffected: 6.16 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/marvell/octeontx2/nic/qos.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5df8db01d6a4e9c35a5ba5d7e130d5cecd3ffcb4",
              "status": "affected",
              "version": "5e6808b4c68d7882971514ab3279926eb07c8b2d",
              "versionType": "git"
            },
            {
              "lessThan": "ec62c99914a79d84c8de5ba1b94d62f2ed721f2a",
              "status": "affected",
              "version": "5e6808b4c68d7882971514ab3279926eb07c8b2d",
              "versionType": "git"
            },
            {
              "lessThan": "f1fca0eae5a0573f226f46c6871260278e7dda12",
              "status": "affected",
              "version": "5e6808b4c68d7882971514ab3279926eb07c8b2d",
              "versionType": "git"
            },
            {
              "lessThan": "67af4ec948e8ce3ea53a9cf614d01fddf172e56d",
              "status": "affected",
              "version": "5e6808b4c68d7882971514ab3279926eb07c8b2d",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/marvell/octeontx2/nic/qos.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.5"
            },
            {
              "lessThan": "6.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.94",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.34",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.94",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.34",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.3",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nocteontx2-pf: QOS: Refactor TC_HTB_LEAF_DEL_LAST callback\n\nThis patch addresses below issues,\n\n1. Active traffic on the leaf node must be stopped before its send queue\n   is reassigned to the parent. This patch resolves the issue by marking\n   the node as \u0027Inner\u0027.\n\n2. During a system reboot, the interface receives TC_HTB_LEAF_DEL\n   and TC_HTB_LEAF_DEL_LAST callbacks to delete its HTB queues.\n   In the case of TC_HTB_LEAF_DEL_LAST, although the same send queue\n   is reassigned to the parent, the current logic still attempts to update\n   the real number of queues, leadning to below warnings\n\n        New queues can\u0027t be registered after device unregistration.\n        WARNING: CPU: 0 PID: 6475 at net/core/net-sysfs.c:1714\n        netdev_queue_update_kobjects+0x1e4/0x200"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable callback is reached through the tc/netlink qdisc configuration interface (RTM_DELTCLASS \u2192 htb_destroy_class_offload \u2192 TC_HTB_LEAF_DEL_LAST), which requires local access to a netlink socket. Per kernel scoring guidance, tc/netlink qdisc paths are Local.\nAC:L - The attacker controls both sides of the race \u2014 issuing the class deletion and concurrently transmitting traffic steered to that classid \u2014 and the window spans several synchronous AF mailbox round-trips (SMQ flush, context disable, NDC sync), making it trivially winnable. The second defect (the WARN on re-growing tx queues after unregistration) is fully deterministic and needs no race at all.\nPR:L - The path is gated only by netlink_net_capable(CAP_NET_ADMIN), which is satisfied by CAP_NET_ADMIN in the user namespace owning the network namespace and is therefore obtainable by an unprivileged user via unshare -Urn. octeontx2 VFs also register ndo_setup_tc, so a container or VM handed an SR-IOV VF \u2014 the standard OcteonTX2/CN10K DPU deployment \u2014 can reach this without any host privilege.\nUI:N - The attacker performs the class deletion and generates the concurrent traffic entirely on their own; no victim action is needed. The unregistration variant fires on any reboot or interface teardown that the attacker can also initiate themselves.\nS:U - The corruption and crash occur within the kernel\u0027s own security authority on the affected host, with no crossing of a VM, IOMMU, or sandbox boundary. This is a standard in-kernel memory-safety issue.\nC:H - The race yields a use-after-free on the send-queue resources (freed sq-\u003esqe, sq-\u003esg, sq-\u003esqb_ptrs, pool-\u003efc_addr) and on the RCU-looked-up qos node itself, which is kfree()d immediately after hash_del_rcu() with no grace period. UAF of these structures lets an attacker reclaim the slabs with controlled data and read back kernel memory contents, so High is appropriate.\nI:H - The transmit path writes into the freed memory \u2014 memset(sq-\u003esqe_base + 8, ...) and SG-descriptor stores into the freed sq-\u003esg \u2014 and the NIC subsequently DMAs into pages already put_page()d and dma_unmap()ed. This is an attacker-influenceable out-of-bounds/UAF write suitable for heap grooming and control-flow corruption.\nA:H - The use-after-free on freed DMA-coherent memory and released SQB pages causes oopses, IOMMU faults and NIC datapath wedging, and the second defect produces a WARN splat at net/core/net-sysfs.c on every unregistration, which is a full panic under panic_on_warn. Any such kernel crash is High."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:00:56.990Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5df8db01d6a4e9c35a5ba5d7e130d5cecd3ffcb4"
        },
        {
          "url": "https://git.kernel.org/stable/c/ec62c99914a79d84c8de5ba1b94d62f2ed721f2a"
        },
        {
          "url": "https://git.kernel.org/stable/c/f1fca0eae5a0573f226f46c6871260278e7dda12"
        },
        {
          "url": "https://git.kernel.org/stable/c/67af4ec948e8ce3ea53a9cf614d01fddf172e56d"
        }
      ],
      "title": "octeontx2-pf: QOS: Refactor TC_HTB_LEAF_DEL_LAST callback",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38278",
    "datePublished": "2025-07-10T07:41:57.546Z",
    "dateReserved": "2025-04-16T04:51:23.998Z",
    "dateUpdated": "2026-08-05T12:00:56.990Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-38278",
      "date": "2026-08-06",
      "epss": "0.00168",
      "percentile": "0.06368"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-18T15:02:53.000Z",
      "cve": "CVE-2025-38278",
      "id": "msrc_CVE-2025-38278",
      "initial_release_date": "2025-07-02T00:00:00.000Z",
      "product_status:known_not_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "octeontx2-pf: QOS: Refactor TC_HTB_LEAF_DEL_LAST callback",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-38278.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-38278\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-07-10T08:15:26.123\",\"lastModified\":\"2026-07-30T06:23:05.833\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nocteontx2-pf: QOS: Refactor TC_HTB_LEAF_DEL_LAST callback\\n\\nThis patch addresses below issues,\\n\\n1. Active traffic on the leaf node must be stopped before its send queue\\n   is reassigned to the parent. This patch resolves the issue by marking\\n   the node as \u0027Inner\u0027.\\n\\n2. During a system reboot, the interface receives TC_HTB_LEAF_DEL\\n   and TC_HTB_LEAF_DEL_LAST callbacks to delete its HTB queues.\\n   In the case of TC_HTB_LEAF_DEL_LAST, although the same send queue\\n   is reassigned to the parent, the current logic still attempts to update\\n   the real number of queues, leadning to below warnings\\n\\n        New queues can\u0027t be registered after device unregistration.\\n        WARNING: CPU: 0 PID: 6475 at net/core/net-sysfs.c:1714\\n        netdev_queue_update_kobjects+0x1e4/0x200\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: octeontx2-pf: QOS: Refactorizar la devoluci\u00f3n de llamada TC_HTB_LEAF_DEL_LAST Este parche soluciona los siguientes problemas: 1. El tr\u00e1fico activo en el nodo hoja debe detenerse antes de que su cola de env\u00edo se reasigne al padre. Este parche resuelve el problema marcando el nodo como \\\"interno\\\". 2. Durante un reinicio del sistema, la interfaz recibe las devoluciones de llamada TC_HTB_LEAF_DEL y TC_HTB_LEAF_DEL_LAST para eliminar sus colas HTB. En el caso de TC_HTB_LEAF_DEL_LAST, aunque la misma cola de env\u00edo se reasigne al padre, la l\u00f3gica actual a\u00fan intenta actualizar el n\u00famero real de colas, lo que genera las siguientes advertencias No se pueden registrar nuevas colas despu\u00e9s de anular el registro del dispositivo. ADVERTENCIA: CPU: 0 PID: 6475 en net/core/net-sysfs.c:1714 netdev_queue_update_kobjects+0x1e4/0x200\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/ethernet/marvell/octeontx2/nic/qos.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5e6808b4c68d7882971514ab3279926eb07c8b2d\",\"lessThan\":\"5df8db01d6a4e9c35a5ba5d7e130d5cecd3ffcb4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5e6808b4c68d7882971514ab3279926eb07c8b2d\",\"lessThan\":\"ec62c99914a79d84c8de5ba1b94d62f2ed721f2a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5e6808b4c68d7882971514ab3279926eb07c8b2d\",\"lessThan\":\"f1fca0eae5a0573f226f46c6871260278e7dda12\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5e6808b4c68d7882971514ab3279926eb07c8b2d\",\"lessThan\":\"67af4ec948e8ce3ea53a9cf614d01fddf172e56d\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/ethernet/marvell/octeontx2/nic/qos.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.5\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.5\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.94\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.34\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.15.3\",\"lessThanOrEqual\":\"6.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.16\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.5\",\"versionEndExcluding\":\"6.6.94\",\"matchCriteriaId\":\"3D3A3F5D-1F88-4BFE-92A6-43E827D27BE3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.34\",\"matchCriteriaId\":\"4FFA54AA-CDFE-4591-BD07-72813D0948F4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.15.3\",\"matchCriteriaId\":\"0541C761-BD5E-4C1A-8432-83B375D7EB92\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/5df8db01d6a4e9c35a5ba5d7e130d5cecd3ffcb4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/67af4ec948e8ce3ea53a9cf614d01fddf172e56d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ec62c99914a79d84c8de5ba1b94d62f2ed721f2a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f1fca0eae5a0573f226f46c6871260278e7dda12\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-07-30T10:11:46+00:00",
      "cve": "CVE-2025-38278",
      "id": "CVE-2025-38278",
      "initial_release_date": "2025-07-10T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: octeontx2-pf: QOS: Refactor TC_HTB_LEAF_DEL_LAST callback",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-38278.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-31T01:11:21Z",
      "cve": "CVE-2025-38278",
      "id": "CVE-2025-38278",
      "initial_release_date": "2025-07-10T23:23:32Z",
      "product_status:first_fixed": "2",
      "product_status:known_not_affected": "277",
      "product_status:recommended": "154",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-38278",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-38278.json",
      "version": "31"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.