net/sched: Always pass notifications when child class becomes empty

MITRE NVD CVE.ORG JSON API Print: PDF PDF

Summary

CVECVE-2025-38350
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2025-07-19 07:15:22 UTC
Updated2026-05-12 13:16:48 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: net/sched: Always pass notifications when child class becomes empty Certain classful qdiscs may invoke their classes' dequeue handler on an enqueue operation. This may unexpectedly empty the child qdisc and thus make an in-flight class passive via qlen_notify(). Most qdiscs do not expect such behaviour at this point in time and may re-activate the class eventually anyways which will lead to a use-after-free. The referenced fix commit attempted to fix this behavior for the HFSC case by moving the backlog accounting around, though this turned out to be incomplete since the parent's parent may run into the issue too. The following reproducer demonstrates this use-after-free: tc qdisc add dev lo root handle 1: drr tc filter add dev lo parent 1: basic classid 1:1 tc class add dev lo parent 1: classid 1:1 drr tc qdisc add dev lo parent 1:1 handle 2: hfsc def 1 tc class add dev lo parent 2: classid 2:1 hfsc rt m1 8 d 1 m2 0 tc qdisc add dev lo parent 2:1 handle 3: netem tc qdisc add dev lo parent 3:1 handle 4: blackhole echo 1 | socat -u STDIN UDP4-DATAGRAM:127.0.0.1:8888 tc class delete dev lo classid 1:1 echo 1 | socat -u STDIN UDP4-DATAGRAM:127.0.0.1:8888 Since backlog accounting issues leading to a use-after-frees on stale class pointers is a recurring pattern at this point, this patch takes a different approach. Instead of trying to fix the accounting, the patch ensures that qdisc_tree_reduce_backlog always calls qlen_notify when the child qdisc is empty. This solves the problem because deletion of qdiscs always involves a call to qdisc_reset() and / or qdisc_purge_queue() which ultimately resets its qlen to 0 thus causing the following qdisc_tree_reduce_backlog() to report to the parent. Note that this may call qlen_notify on passive classes multiple times. This is not a problem after the recent patch series that made all the classful qdiscs qlen_notify() handlers idempotent.

Risk And Classification

Primary CVSS: v3.1 7.8 HIGH from [email protected]

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Problem Types: CWE-416

CVSS v3.1 Breakdown

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD Known Affected Configurations (CPE 2.3)

TypeVendorProductVersionUpdateEditionLanguage
Operating System Linux Linux Kernel All All All All

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected 1034e3310752e8675e313f7271b348914008719a 3b290923ad2b23596208c1e29520badef4356a43 git Not specified
CNA Linux Linux affected f9f593e34d2fb67644372c8f7b033bdc622ad228 e9921b57dca05ac5f4fa1fa8e993d4f0ee52e2b7 git Not specified
CNA Linux Linux affected 89c301e929a0db14ebd94b4d97764ce1d6981653 e269f29e9395527bc00c213c6b15da04ebb35070 git Not specified
CNA Linux Linux affected f1dde3eb17dc1b8bd07aed00004b1e05fc87a3d4 7874c9c132e906a52a187d045995b115973c93fb git Not specified
CNA Linux Linux affected 93c276942e75de0e5bc91576300d292e968f5a02 f680a4643c6f71e758d8fe0431a958e9a6a4f59d git Not specified
CNA Linux Linux affected 49b21795b8e5654a7df3d910a12e1060da4c04cf a553afd91f55ff39b1e8a1c4989a29394c9e0472 git Not specified
CNA Linux Linux affected 3f981138109f63232a5fb7165938d4c945cc1b9d a44acdd9e84a211989ff4b9b92bf3545d8456ad5 git Not specified
CNA Linux Linux affected 3f981138109f63232a5fb7165938d4c945cc1b9d 103406b38c600fec1fe375a77b27d87e314aea09 git Not specified
CNA Linux Linux affected 3f3a22eebbc32b4fa8ce9c1d5f9db214b45b9335 git Not specified
CNA Linux Linux affected 6.15 Not specified
CNA Linux Linux unaffected 6.15 semver Not specified
CNA Linux Linux unaffected 5.4.296 5.4.* semver Not specified
CNA Linux Linux unaffected 5.10.240 5.10.* semver Not specified
CNA Linux Linux unaffected 5.15.187 5.15.* semver Not specified
CNA Linux Linux unaffected 6.1.144 6.1.* semver Not specified
CNA Linux Linux unaffected 6.6.97 6.6.* semver Not specified
CNA Linux Linux unaffected 6.12.37 6.12.* semver Not specified
CNA Linux Linux unaffected 6.15.6 6.15.* semver Not specified
CNA Linux Linux unaffected 6.16 * original_commit_for_fix Not specified
ADP Siemens RUGGEDCOM RST2428P affected V3.3 custom Not specified
ADP Siemens SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 Family affected V3.3 custom Not specified
ADP Siemens SCALANCE XCH328 affected V3.3 custom Not specified
ADP Siemens SCALANCE XCM324 affected V3.3 custom Not specified
ADP Siemens SCALANCE XCM328 affected V3.3 custom Not specified
ADP Siemens SCALANCE XCM332 affected V3.3 custom Not specified
ADP Siemens SCALANCE XRH334 24 V DC 8xFO CC affected V3.3 custom Not specified
ADP Siemens SCALANCE XRM334 230 V AC 12xFO affected V3.3 custom Not specified
ADP Siemens SCALANCE XRM334 230 V AC 8xFO affected V3.3 custom Not specified
ADP Siemens SCALANCE XRM334 230V AC 2x10G 24xSFP 8xSFP affected V3.3 custom Not specified
ADP Siemens SCALANCE XRM334 24 V DC 12xFO affected V3.3 custom Not specified
ADP Siemens SCALANCE XRM334 24 V DC 8xFO affected V3.3 custom Not specified
ADP Siemens SCALANCE XRM334 24V DC 2x10G 24xSFP 8xSFP affected V3.3 custom Not specified
ADP Siemens SCALANCE XRM334 2x230 V AC 12xFO affected V3.3 custom Not specified
ADP Siemens SCALANCE XRM334 2x230 V AC 8xFO affected V3.3 custom Not specified
ADP Siemens SCALANCE XRM334 2x230V AC 2x10G 24xSFP 8xSFP affected V3.3 custom Not specified
ADP Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP affected V3.1.5 * custom Not specified
ADP Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP affected V3.1.5 * custom Not specified
ADP Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP affected V3.1.5 * custom Not specified
ADP Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP affected V3.1.5 * custom Not specified
ADP Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP affected V3.1.5 * custom Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/e269f29e9395527bc00c213c6b15da04ebb35070 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
lists.debian.org/debian-lts-announce/2025/10/msg00008.html af854a3a-2127-422b-91ae-364da2661108 lists.debian.org Third Party Advisory
cert-portal.siemens.com/productcert/html/ssa-089022.html 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e cert-portal.siemens.com
cert-portal.siemens.com/productcert/html/ssa-082556.html 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e cert-portal.siemens.com
git.kernel.org/stable/c/e9921b57dca05ac5f4fa1fa8e993d4f0ee52e2b7 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
git.kernel.org/stable/c/f680a4643c6f71e758d8fe0431a958e9a6a4f59d 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
git.kernel.org/stable/c/7874c9c132e906a52a187d045995b115973c93fb 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
git.kernel.org/stable/c/103406b38c600fec1fe375a77b27d87e314aea09 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
git.kernel.org/stable/c/a44acdd9e84a211989ff4b9b92bf3545d8456ad5 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
git.kernel.org/stable/c/a553afd91f55ff39b1e8a1c4989a29394c9e0472 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
git.kernel.org/stable/c/3b290923ad2b23596208c1e29520badef4356a43 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
lists.debian.org/debian-lts-announce/2025/10/msg00007.html af854a3a-2127-422b-91ae-364da2661108 lists.debian.org Third Party Advisory
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis
© CVE.report 2026 |

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report