GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2025-38177 (GCVE-0-2025-38177)

Vulnerability from cvelistv5 – Published: 2025-07-04 12:47 – Updated: 2026-08-05 12:00
VLAI
Title
sch_hfsc: make hfsc_qlen_notify() idempotent
Summary
In the Linux kernel, the following vulnerability has been resolved: sch_hfsc: make hfsc_qlen_notify() idempotent hfsc_qlen_notify() is not idempotent either and not friendly to its callers, like fq_codel_dequeue(). Let's make it idempotent to ease qdisc_tree_reduce_backlog() callers' life: 1. update_vf() decreases cl->cl_nactive, so we can check whether it is non-zero before calling it. 2. eltree_remove() always removes RB node cl->el_node, but we can use RB_EMPTY_NODE() + RB_CLEAR_NODE() to make it safe.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-10 20:40 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 959466588aa7f84ccf79ae36a1d89542eaf9aaec , < 9a5fd5c2f4d4afdd5e405083ee53e0789ce76956 (git)
Affected: 959466588aa7f84ccf79ae36a1d89542eaf9aaec , < 72c61ffbeeb8c50f6d4d70c65d3283aa1bac57a7 (git)
Affected: 959466588aa7f84ccf79ae36a1d89542eaf9aaec , < a5efc95a33bd4fcb879250852828cc58c7862970 (git)
Affected: 959466588aa7f84ccf79ae36a1d89542eaf9aaec , < 0475c85426b18eccdcb7f9fb58d8f8e9c6c58c87 (git)
Affected: 959466588aa7f84ccf79ae36a1d89542eaf9aaec , < 9030a91235ae4845ec71902c3e0cecfc9ed1f2df (git)
Affected: 959466588aa7f84ccf79ae36a1d89542eaf9aaec , < d06476714d2819b550e0cc39222347e2c8941c9d (git)
Affected: 959466588aa7f84ccf79ae36a1d89542eaf9aaec , < c1175c4ad01dbc9c979d099861fa90a754f72059 (git)
Affected: 959466588aa7f84ccf79ae36a1d89542eaf9aaec , < 51eb3b65544c9efd6a1026889ee5fb5aa62da3bb (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.14
Unaffected: 0 , < 4.14 (semver)
Unaffected: 5.4.297 , ≤ 5.4.* (semver)
Unaffected: 5.10.241 , ≤ 5.10.* (semver)
Unaffected: 5.15.190 , ≤ 5.15.* (semver)
Unaffected: 6.1.138 , ≤ 6.1.* (semver)
Unaffected: 6.6.90 , ≤ 6.6.* (semver)
Unaffected: 6.12.28 , ≤ 6.12.* (semver)
Unaffected: 6.14.6 , ≤ 6.14.* (semver)
Unaffected: 6.15 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T19:58:30.487Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/08/msg00010.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-38177",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-10T20:40:35.261574Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-11T18:44:03.284Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/sched/sch_hfsc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9a5fd5c2f4d4afdd5e405083ee53e0789ce76956",
              "status": "affected",
              "version": "959466588aa7f84ccf79ae36a1d89542eaf9aaec",
              "versionType": "git"
            },
            {
              "lessThan": "72c61ffbeeb8c50f6d4d70c65d3283aa1bac57a7",
              "status": "affected",
              "version": "959466588aa7f84ccf79ae36a1d89542eaf9aaec",
              "versionType": "git"
            },
            {
              "lessThan": "a5efc95a33bd4fcb879250852828cc58c7862970",
              "status": "affected",
              "version": "959466588aa7f84ccf79ae36a1d89542eaf9aaec",
              "versionType": "git"
            },
            {
              "lessThan": "0475c85426b18eccdcb7f9fb58d8f8e9c6c58c87",
              "status": "affected",
              "version": "959466588aa7f84ccf79ae36a1d89542eaf9aaec",
              "versionType": "git"
            },
            {
              "lessThan": "9030a91235ae4845ec71902c3e0cecfc9ed1f2df",
              "status": "affected",
              "version": "959466588aa7f84ccf79ae36a1d89542eaf9aaec",
              "versionType": "git"
            },
            {
              "lessThan": "d06476714d2819b550e0cc39222347e2c8941c9d",
              "status": "affected",
              "version": "959466588aa7f84ccf79ae36a1d89542eaf9aaec",
              "versionType": "git"
            },
            {
              "lessThan": "c1175c4ad01dbc9c979d099861fa90a754f72059",
              "status": "affected",
              "version": "959466588aa7f84ccf79ae36a1d89542eaf9aaec",
              "versionType": "git"
            },
            {
              "lessThan": "51eb3b65544c9efd6a1026889ee5fb5aa62da3bb",
              "status": "affected",
              "version": "959466588aa7f84ccf79ae36a1d89542eaf9aaec",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/sched/sch_hfsc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.14"
            },
            {
              "lessThan": "4.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.297",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.241",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.190",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.138",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.90",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.28",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.14.*",
              "status": "unaffected",
              "version": "6.14.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.15",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.297",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.241",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.190",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.138",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.90",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.28",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14.6",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsch_hfsc: make hfsc_qlen_notify() idempotent\n\nhfsc_qlen_notify() is not idempotent either and not friendly\nto its callers, like fq_codel_dequeue(). Let\u0027s make it idempotent\nto ease qdisc_tree_reduce_backlog() callers\u0027 life:\n\n1. update_vf() decreases cl-\u003ecl_nactive, so we can check whether it is\nnon-zero before calling it.\n\n2. eltree_remove() always removes RB node cl-\u003eel_node, but we can use\n   RB_EMPTY_NODE() + RB_CLEAR_NODE() to make it safe."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable path is reached by configuring HFSC classes and child qdiscs via rtnetlink (`tc`) and driving local packet flow through them, which requires local system access. Remote packets alone cannot establish the required qdisc hierarchy.\nAC:L - The attacker fully controls every precondition \u2014 the qdisc/class topology, the child qdisc that re-enters `qdisc_tree_reduce_backlog()`, the packet, and the class deletion \u2014 and the sibling commit ships a deterministic shell reproducer. This is a reentrancy/accounting bug, not a race the attacker must win.\nPR:L - `tc` qdisc/class operations are gated by `netlink_net_capable(skb, CAP_NET_ADMIN)`, which resolves to `netlink_ns_capable(skb, sock_net(sk)-\u003euser_ns, ...)` \u2014 namespace-relative, so an unprivileged user obtains it with `unshare -Urn` and can build the full hierarchy on `lo` inside that netns.\nUI:N - The attacker performs the qdisc setup, packet transmission, and class deletion entirely on their own; no victim action or cooperation is needed.\nS:U - The corruption is confined to kernel memory within the same security authority; there is no VM, IOMMU, or sandbox boundary crossed.\nC:H - Dangling `hfsc_class` rb_nodes left in `q-\u003eeligible`/`vt_tree` are dereferenced by `eltree_get_mindl()`/`vttree_get_minvt()` after `kfree()`, giving a use-after-free read over reclaimed heap contents the attacker can spray, enabling arbitrary kernel memory disclosure.\nI:H - Double `rb_erase()` on a stale node writes through an attacker-influenceable parent pointer, and subsequent `eltree_update()`/`rb_insert` operate on freed memory \u2014 yielding a write primitive; the same HFSC rbtree-corruption primitive has a public working local privilege escalation (CVE-2025-38001, \"rbtree family drama\").\nA:H - Red-black tree corruption and use-after-free on freed `hfsc_class` objects reliably produce oopses, KASAN splats, and kernel panics, taking the system down."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:00:08.513Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9a5fd5c2f4d4afdd5e405083ee53e0789ce76956"
        },
        {
          "url": "https://git.kernel.org/stable/c/72c61ffbeeb8c50f6d4d70c65d3283aa1bac57a7"
        },
        {
          "url": "https://git.kernel.org/stable/c/a5efc95a33bd4fcb879250852828cc58c7862970"
        },
        {
          "url": "https://git.kernel.org/stable/c/0475c85426b18eccdcb7f9fb58d8f8e9c6c58c87"
        },
        {
          "url": "https://git.kernel.org/stable/c/9030a91235ae4845ec71902c3e0cecfc9ed1f2df"
        },
        {
          "url": "https://git.kernel.org/stable/c/d06476714d2819b550e0cc39222347e2c8941c9d"
        },
        {
          "url": "https://git.kernel.org/stable/c/c1175c4ad01dbc9c979d099861fa90a754f72059"
        },
        {
          "url": "https://git.kernel.org/stable/c/51eb3b65544c9efd6a1026889ee5fb5aa62da3bb"
        }
      ],
      "title": "sch_hfsc: make hfsc_qlen_notify() idempotent",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38177",
    "datePublished": "2025-07-04T12:47:09.127Z",
    "dateReserved": "2025-04-16T04:51:23.992Z",
    "dateUpdated": "2026-08-05T12:00:08.513Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-38177",
      "date": "2026-09-15",
      "epss": "0.00167",
      "percentile": "0.06344"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-24T14:37:21.000Z",
      "cve": "CVE-2025-38177",
      "id": "msrc_CVE-2025-38177",
      "initial_release_date": "2025-07-02T00:00:00.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "sch_hfsc: make hfsc_qlen_notify() idempotent",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-38177.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-38177\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-07-04T13:15:24.033\",\"lastModified\":\"2026-07-30T06:22:57.540\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nsch_hfsc: make hfsc_qlen_notify() idempotent\\n\\nhfsc_qlen_notify() is not idempotent either and not friendly\\nto its callers, like fq_codel_dequeue(). Let\u0027s make it idempotent\\nto ease qdisc_tree_reduce_backlog() callers\u0027 life:\\n\\n1. update_vf() decreases cl-\u003ecl_nactive, so we can check whether it is\\nnon-zero before calling it.\\n\\n2. eltree_remove() always removes RB node cl-\u003eel_node, but we can use\\n   RB_EMPTY_NODE() + RB_CLEAR_NODE() to make it safe.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: sch_hfsc: hace que hfsc_qlen_notify() sea idempotente. hfsc_qlen_notify() tampoco es idempotente y no es compatible con quienes lo llaman, como fq_codel_dequeue(). Vamos a convertirlo en idempotente para simplificar la tarea de quienes llaman a qdisc_tree_reduce_backlog(): 1. update_vf() reduce cl-\u0026gt;cl_nactive, lo que permite comprobar si es distinto de cero antes de llamarlo. 2. eltree_remove() siempre elimina el nodo RB cl-\u0026gt;el_node, pero podemos usar RB_EMPTY_NODE() + RB_CLEAR_NODE() para hacerlo seguro.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/sched/sch_hfsc.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"959466588aa7f84ccf79ae36a1d89542eaf9aaec\",\"lessThan\":\"9a5fd5c2f4d4afdd5e405083ee53e0789ce76956\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"959466588aa7f84ccf79ae36a1d89542eaf9aaec\",\"lessThan\":\"72c61ffbeeb8c50f6d4d70c65d3283aa1bac57a7\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"959466588aa7f84ccf79ae36a1d89542eaf9aaec\",\"lessThan\":\"a5efc95a33bd4fcb879250852828cc58c7862970\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"959466588aa7f84ccf79ae36a1d89542eaf9aaec\",\"lessThan\":\"0475c85426b18eccdcb7f9fb58d8f8e9c6c58c87\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"959466588aa7f84ccf79ae36a1d89542eaf9aaec\",\"lessThan\":\"9030a91235ae4845ec71902c3e0cecfc9ed1f2df\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"959466588aa7f84ccf79ae36a1d89542eaf9aaec\",\"lessThan\":\"d06476714d2819b550e0cc39222347e2c8941c9d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"959466588aa7f84ccf79ae36a1d89542eaf9aaec\",\"lessThan\":\"c1175c4ad01dbc9c979d099861fa90a754f72059\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"959466588aa7f84ccf79ae36a1d89542eaf9aaec\",\"lessThan\":\"51eb3b65544c9efd6a1026889ee5fb5aa62da3bb\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/sched/sch_hfsc.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.14\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.14\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.297\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.241\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.190\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.138\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.90\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.28\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.14.6\",\"lessThanOrEqual\":\"6.14.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.15\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-06-10T20:40:35.261574Z\",\"id\":\"CVE-2025-38177\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-459\"},{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"5.4.297\",\"matchCriteriaId\":\"AD1E1D52-6870-4D04-B412-807D9DC2CDC1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.241\",\"matchCriteriaId\":\"D0D21C35-EB8A-488A-BBF9-403E4817E5DD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.190\",\"matchCriteriaId\":\"AD9E597F-3DDE-4D7E-976C-463D0611F13F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.138\",\"matchCriteriaId\":\"B6266F82-46B4-4D38-AC4A-54C92A1DFAB2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.90\",\"matchCriteriaId\":\"2BE1DB09-2D62-4C63-AF19-947300669741\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.28\",\"matchCriteriaId\":\"5082CE19-0F3D-4521-AB3E-810D8255F500\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.14.6\",\"matchCriteriaId\":\"19E5095E-5950-43EA-8E78-FC860855293F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.15:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"8D465631-2980-487A-8E65-40AE2B9F8ED1\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FA6FEEC2-9F11-4643-8827-749718254FED\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0475c85426b18eccdcb7f9fb58d8f8e9c6c58c87\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/51eb3b65544c9efd6a1026889ee5fb5aa62da3bb\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/72c61ffbeeb8c50f6d4d70c65d3283aa1bac57a7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9030a91235ae4845ec71902c3e0cecfc9ed1f2df\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9a5fd5c2f4d4afdd5e405083ee53e0789ce76956\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a5efc95a33bd4fcb879250852828cc58c7862970\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c1175c4ad01dbc9c979d099861fa90a754f72059\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d06476714d2819b550e0cc39222347e2c8941c9d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/08/msg00010.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-30T09:13:14+00:00",
      "cve": "CVE-2025-38177",
      "id": "CVE-2025-38177",
      "initial_release_date": "2025-07-04T00:00:00+00:00",
      "product_status:fixed": "1039",
      "product_status:known_affected": "246",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: sch_hfsc: make hfsc_qlen_notify() idempotent",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-38177.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-13T23:39:40Z",
      "cve": "CVE-2025-38177",
      "id": "CVE-2025-38177",
      "initial_release_date": "2025-07-07T23:24:28Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "267",
      "product_status:recommended": "855",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-38177",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-38177.json",
      "version": "60"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html\"}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2025/08/msg00010.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T19:58:30.487Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-38177\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-06-10T20:40:35.261574Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-06-11T17:37:27.468Z\"}}], \"cna\": {\"title\": \"sch_hfsc: make hfsc_qlen_notify() idempotent\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"959466588aa7f84ccf79ae36a1d89542eaf9aaec\", \"lessThan\": \"9a5fd5c2f4d4afdd5e405083ee53e0789ce76956\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"959466588aa7f84ccf79ae36a1d89542eaf9aaec\", \"lessThan\": \"72c61ffbeeb8c50f6d4d70c65d3283aa1bac57a7\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"959466588aa7f84ccf79ae36a1d89542eaf9aaec\", \"lessThan\": \"a5efc95a33bd4fcb879250852828cc58c7862970\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"959466588aa7f84ccf79ae36a1d89542eaf9aaec\", \"lessThan\": \"0475c85426b18eccdcb7f9fb58d8f8e9c6c58c87\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"959466588aa7f84ccf79ae36a1d89542eaf9aaec\", \"lessThan\": \"9030a91235ae4845ec71902c3e0cecfc9ed1f2df\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"959466588aa7f84ccf79ae36a1d89542eaf9aaec\", \"lessThan\": \"d06476714d2819b550e0cc39222347e2c8941c9d\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"959466588aa7f84ccf79ae36a1d89542eaf9aaec\", \"lessThan\": \"c1175c4ad01dbc9c979d099861fa90a754f72059\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"959466588aa7f84ccf79ae36a1d89542eaf9aaec\", \"lessThan\": \"51eb3b65544c9efd6a1026889ee5fb5aa62da3bb\", \"versionType\": \"git\"}], \"programFiles\": [\"net/sched/sch_hfsc.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.14\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"4.14\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.4.297\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.241\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.190\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.138\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.90\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12.28\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.12.*\"}, {\"status\": \"unaffected\", \"version\": \"6.14.6\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.14.*\"}, {\"status\": \"unaffected\", \"version\": \"6.15\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"net/sched/sch_hfsc.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/9a5fd5c2f4d4afdd5e405083ee53e0789ce76956\"}, {\"url\": \"https://git.kernel.org/stable/c/72c61ffbeeb8c50f6d4d70c65d3283aa1bac57a7\"}, {\"url\": \"https://git.kernel.org/stable/c/a5efc95a33bd4fcb879250852828cc58c7862970\"}, {\"url\": \"https://git.kernel.org/stable/c/0475c85426b18eccdcb7f9fb58d8f8e9c6c58c87\"}, {\"url\": \"https://git.kernel.org/stable/c/9030a91235ae4845ec71902c3e0cecfc9ed1f2df\"}, {\"url\": \"https://git.kernel.org/stable/c/d06476714d2819b550e0cc39222347e2c8941c9d\"}, {\"url\": \"https://git.kernel.org/stable/c/c1175c4ad01dbc9c979d099861fa90a754f72059\"}, {\"url\": \"https://git.kernel.org/stable/c/51eb3b65544c9efd6a1026889ee5fb5aa62da3bb\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nsch_hfsc: make hfsc_qlen_notify() idempotent\\n\\nhfsc_qlen_notify() is not idempotent either and not friendly\\nto its callers, like fq_codel_dequeue(). Let\u0027s make it idempotent\\nto ease qdisc_tree_reduce_backlog() callers\u0027 life:\\n\\n1. update_vf() decreases cl-\u003ecl_nactive, so we can check whether it is\\nnon-zero before calling it.\\n\\n2. eltree_remove() always removes RB node cl-\u003eel_node, but we can use\\n   RB_EMPTY_NODE() + RB_CLEAR_NODE() to make it safe.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.297\", \"versionStartIncluding\": \"4.14\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.241\", \"versionStartIncluding\": \"4.14\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.190\", \"versionStartIncluding\": \"4.14\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.138\", \"versionStartIncluding\": \"4.14\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.90\", \"versionStartIncluding\": \"4.14\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12.28\", \"versionStartIncluding\": \"4.14\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.14.6\", \"versionStartIncluding\": \"4.14\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.15\", \"versionStartIncluding\": \"4.14\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-07-30T05:51:57.566Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-38177\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-07-30T05:51:57.566Z\", \"dateReserved\": \"2025-04-16T04:51:23.992Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2025-07-04T12:47:09.127Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.