VulnerabilityPublished 25 Jul 2025Updated 5 Nov 2026

CVE-2025-38457: Linux kernel · net/sched: Abort __tc_modify_qdisc if parent class does not exist

Affects Linux kernelSource CVE Database V5

Compare

Not known to be exploited · fixed in ffdde7bf5a439aaa1955ebd581f5c64ab1533963 : update Linux kernel when convenient.

Data as of 5 Nov 2026, 21:19 UTC

Severity

Unrated

Rated by Threat Radar · No CVSS score from NVD or the CNA

Thin evidence

One scorer or none

Exploitation: No evidence of active exploitation and no public proof of concept
Automatable: Attackers cannot reliably automate steps 1–4 of the kill chain
Technical impact: Limited control over the software or limited information exposure

CISA SSVC assessment, 2026-11-05.

Patch

Available – fixed in ffdde7bf5a439aaa1955ebd581f5c64ab1533963, e28a383d6485c3bb51dc5953552f76c4dea33eea, 25452638f133ac19d75af3f928327d8016952c8e +5

Exploitation evidence

Disclosed: evidence found.
CVE published 25 Jul 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 5 Nov 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 5e50da01d0ce7ef0ba3ed6cfabd62f327da0aca6, < ffdde7bf5a439aaa1955ebd581f5c64ab1533963	Fixed in ffdde7bf5a439aaa1955ebd581f5c64ab1533963
LinuxLinux	Affected ≥ 5e50da01d0ce7ef0ba3ed6cfabd62f327da0aca6, < e28a383d6485c3bb51dc5953552f76c4dea33eea	Fixed in e28a383d6485c3bb51dc5953552f76c4dea33eea
LinuxLinux	Affected ≥ 5e50da01d0ce7ef0ba3ed6cfabd62f327da0aca6, < 25452638f133ac19d75af3f928327d8016952c8e	Fixed in 25452638f133ac19d75af3f928327d8016952c8e
LinuxLinux	Affected ≥ 5e50da01d0ce7ef0ba3ed6cfabd62f327da0aca6, < 90436e72c9622c2f70389070088325a3232d339f	Fixed in 90436e72c9622c2f70389070088325a3232d339f
LinuxLinux	Affected ≥ 5e50da01d0ce7ef0ba3ed6cfabd62f327da0aca6, < 923a276c74e25073ae391e930792ac86a9f77f1e	Fixed in 923a276c74e25073ae391e930792ac86a9f77f1e
LinuxLinux	Affected ≥ 5e50da01d0ce7ef0ba3ed6cfabd62f327da0aca6, < 23c165dde88eac405eebb59051ea1fe139a45803	Fixed in 23c165dde88eac405eebb59051ea1fe139a45803

Description

In the Linux kernel, the following vulnerability has been resolved: net/sched: Abort __tc_modify_qdisc if parent class does not exist Lion's patch [1] revealed an ancient bug in the qdisc API. Whenever a user creates/modifies a qdisc specifying as a parent another qdisc, the qdisc API will, during grafting, detect that the user is not trying to attach to a class and reject. However grafting is performed after qdisc_create (and thus the qdiscs' init callback) is executed. In qdiscs that eventually call qdisc_tree_reduce_backlog during init or change (such as fq, hhf, choke, etc), an issue arises. For example, executing the following commands: sudo tc qdisc add dev lo root handle a: htb default 2 sudo tc qdisc add dev lo parent a: handle beef fq Qdiscs such as fq, hhf, choke, etc unconditionally invoke qdisc_tree_reduce_backlog() in their control path init() or change() which then causes a failure to find the child class; however, that does not stop the unconditional invocation of the assumed child qdisc's qlen_notify with a null class. All these qdiscs make the assumption that class is non-null. The solution is ensure that qdisc_leaf() which looks up the parent class, and is invoked prior to qdisc_create(), should return failure on not finding the class. In this patch, we leverage qdisc_leaf to return ERR_PTRs whenever the parentid doesn't correspond to a class, so that we can detect it earlier on and abort before qdisc_create is called. [1] https://lore.kernel.org/netdev/d912cbd7-193b-4269-9857-525bee8bbb6a@gmail.com/

References

Community reviews

Loading reviews…