CVE-2025-38000: Linux kernel · sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue()
Affects Linux kernelSource CVE Database V5
Not known to be exploited.
Data as of 26 Oct 2026, 10:12 UTC
Rated High by the CNA (Linux) · No CVSS score from NVD or the CNA
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 13% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Exploitation evidence
Disclosed: evidence found.
CVE published 6 Jun 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
AI-suggested
European organizations should prioritize updating their Linux kernel versions to include the patch that fixes CVE-2025-38000. Since the vulnerability is in the kernel's HFSC qdisc code, kernel upgrades or backported patches from trusted Linux distributions are essential. Network administrators should audit their use of HFSC queuing disciplines and consider temporarily disabling HFSC or switching to alternative qdiscs if patching is delayed. Monitoring kernel logs for unusual dequeue or packet drop behavior related to HFSC may help detect attempts to trigger the vulnerability. Additionally, applying strict access controls to limit who can configure or interact with network queuing disciplines reduces the risk of exploitation. For embedded or specialized devices running affected kernels, coordinate with vendors for timely firmware updates. Finally, incorporate this vulnerability into incident response and vulnerability management workflows to ensure rapid remediation and detection.
Description
In the Linux kernel, the following vulnerability has been resolved: sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() When enqueuing the first packet to an HFSC class, hfsc_enqueue() calls the child qdisc's peek() operation before incrementing sch->q.qlen and sch->qstats.backlog. If the child qdisc uses qdisc_peek_dequeued(), this may trigger an immediate dequeue and potential packet drop. In such cases, qdisc_tree_reduce_backlog() is called, but the HFSC qdisc's qlen and backlog have not yet been updated, leading to inconsistent queue accounting. This can leave an empty HFSC class in the active list, causing further consequences like use-after-free. This patch fixes the bug by moving the increment of sch->q.qlen and sch->qstats.backlog before the call to the child qdisc's peek() operation. This ensures that queue length and backlog are always accurate when packet drops or dequeues are triggered during the peek.
References
- git.kernel.org/stable/c/1034e3310752e8675e313f7271b348914008719a (opens in a new tab)
- git.kernel.org/stable/c/f9f593e34d2fb67644372c8f7b033bdc622ad228 (opens in a new tab)
- git.kernel.org/stable/c/89c301e929a0db14ebd94b4d97764ce1d6981653 (opens in a new tab)
- git.kernel.org/stable/c/f1dde3eb17dc1b8bd07aed00004b1e05fc87a3d4 (opens in a new tab)
- git.kernel.org/stable/c/93c276942e75de0e5bc91576300d292e968f5a02 (opens in a new tab)
- git.kernel.org/stable/c/49b21795b8e5654a7df3d910a12e1060da4c04cf (opens in a new tab)
- git.kernel.org/stable/c/3f3a22eebbc32b4fa8ce9c1d5f9db214b45b9335 (opens in a new tab)
- git.kernel.org/stable/c/3f981138109f63232a5fb7165938d4c945cc1b9d (opens in a new tab)