CVE-2025-38177

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-38177
In the Linux kernel, the following vulnerability has been resolved: sch_hfsc: make hfsc_qlen_notify() idempotent hfsc_qlen_notify() is not idempotent either and not friendly to its callers, like fq_codel_dequeue(). Let's make it idempotent to ease qdisc_tree_reduce_backlog() callers' life: 1. update_vf() decreases cl->cl_nactive, so we can check whether it is non-zero before calling it. 2. eltree_remove() always removes RB node cl->el_node, but we can use RB_EMPTY_NODE() + RB_CLEAR_NODE() to make it safe.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/0475c85426b18eccdcb7f9fb58d8f8e9c6c58c87 Patch
https://git.kernel.org/stable/c/51eb3b65544c9efd6a1026889ee5fb5aa62da3bb Patch
https://git.kernel.org/stable/c/72c61ffbeeb8c50f6d4d70c65d3283aa1bac57a7 Patch
https://git.kernel.org/stable/c/9030a91235ae4845ec71902c3e0cecfc9ed1f2df Patch
https://git.kernel.org/stable/c/9a5fd5c2f4d4afdd5e405083ee53e0789ce76956 Patch
https://git.kernel.org/stable/c/a5efc95a33bd4fcb879250852828cc58c7862970 Patch
https://git.kernel.org/stable/c/c1175c4ad01dbc9c979d099861fa90a754f72059 Patch
https://git.kernel.org/stable/c/d06476714d2819b550e0cc39222347e2c8941c9d Patch
https://lists.debian.org/debian-lts-announce/2025/08/msg00010.html Third Party Advisory
https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html Third Party Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc1:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
History

18 Dec 2025, 16:48

Type Values Removed Values Added
First Time Linux
Debian
Debian debian Linux
Linux linux Kernel
CPE cpe:2.3:o:linux:linux_kernel:6.15:rc1:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
References () https://git.kernel.org/stable/c/0475c85426b18eccdcb7f9fb58d8f8e9c6c58c87 - () https://git.kernel.org/stable/c/0475c85426b18eccdcb7f9fb58d8f8e9c6c58c87 - Patch
References () https://git.kernel.org/stable/c/51eb3b65544c9efd6a1026889ee5fb5aa62da3bb - () https://git.kernel.org/stable/c/51eb3b65544c9efd6a1026889ee5fb5aa62da3bb - Patch
References () https://git.kernel.org/stable/c/72c61ffbeeb8c50f6d4d70c65d3283aa1bac57a7 - () https://git.kernel.org/stable/c/72c61ffbeeb8c50f6d4d70c65d3283aa1bac57a7 - Patch
References () https://git.kernel.org/stable/c/9030a91235ae4845ec71902c3e0cecfc9ed1f2df - () https://git.kernel.org/stable/c/9030a91235ae4845ec71902c3e0cecfc9ed1f2df - Patch
References () https://git.kernel.org/stable/c/9a5fd5c2f4d4afdd5e405083ee53e0789ce76956 - () https://git.kernel.org/stable/c/9a5fd5c2f4d4afdd5e405083ee53e0789ce76956 - Patch
References () https://git.kernel.org/stable/c/a5efc95a33bd4fcb879250852828cc58c7862970 - () https://git.kernel.org/stable/c/a5efc95a33bd4fcb879250852828cc58c7862970 - Patch
References () https://git.kernel.org/stable/c/c1175c4ad01dbc9c979d099861fa90a754f72059 - () https://git.kernel.org/stable/c/c1175c4ad01dbc9c979d099861fa90a754f72059 - Patch
References () https://git.kernel.org/stable/c/d06476714d2819b550e0cc39222347e2c8941c9d - () https://git.kernel.org/stable/c/d06476714d2819b550e0cc39222347e2c8941c9d - Patch
References () https://lists.debian.org/debian-lts-announce/2025/08/msg00010.html - () https://lists.debian.org/debian-lts-announce/2025/08/msg00010.html - Third Party Advisory
References () https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html - () https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html - Third Party Advisory
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
CWE CWE-459
NVD-CWE-noinfo

03 Nov 2025, 20:18

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2025/08/msg00010.html -

03 Nov 2025, 18:16

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html -

28 Aug 2025, 15:15

Type Values Removed Values Added
References
  • () https://git.kernel.org/stable/c/72c61ffbeeb8c50f6d4d70c65d3283aa1bac57a7 -
  • () https://git.kernel.org/stable/c/9a5fd5c2f4d4afdd5e405083ee53e0789ce76956 -
  • () https://git.kernel.org/stable/c/a5efc95a33bd4fcb879250852828cc58c7862970 -

08 Jul 2025, 16:18

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: sch_hfsc: hace que hfsc_qlen_notify() sea idempotente. hfsc_qlen_notify() tampoco es idempotente y no es compatible con quienes lo llaman, como fq_codel_dequeue(). Vamos a convertirlo en idempotente para simplificar la tarea de quienes llaman a qdisc_tree_reduce_backlog(): 1. update_vf() reduce cl->cl_nactive, lo que permite comprobar si es distinto de cero antes de llamarlo. 2. eltree_remove() siempre elimina el nodo RB cl->el_node, pero podemos usar RB_EMPTY_NODE() + RB_CLEAR_NODE() para hacerlo seguro.

04 Jul 2025, 13:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-07-04 13:15

Updated : 2025-12-18 16:48

NVD link : CVE-2025-38177

Mitre link : CVE-2025-38177

CVE.ORG link : CVE-2025-38177

JSON object : View

Products Affected

debian

  • debian_linux

linux

  • linux_kernel
CWE
CWE-459

Incomplete Cleanup

NVD-CWE-noinfo