Linux azure: In the Linux kernel, the following vulnerability has been resolved: net/sched: Always pass notifications when child class becomes empty Certain… (CVE-2025-38350)
CVE-2025-38350 is a high-severity vulnerability in the Linux kernel's network traffic control subsystem that can lead to privilege escalation on Container-Optimized OS nodes. It affects certain versions of Red Hat Enterprise Linux 8 Real Time kernels and Ubuntu Linux kernels, including those used in Google Kubernetes Engine (GKE) Standard clusters. GKE Autopilot clusters are not impacted by default but may be vulnerable if configured with certain profiles. The vulnerability has been addressed by patches released by Red Hat and Ubuntu, requiring system updates and reboots. Users should upgrade to the specified fixed kernel versions to mitigate the issue.
AI Analysis
Technical Summary
CVE-2025-38350 is a vulnerability in the Linux kernel's net/sched subsystem where notifications were not always passed when a child class becomes empty, leading to potential privilege escalation on Container-Optimized OS nodes. This affects Red Hat Enterprise Linux 8 Real Time kernels prior to version 4.15.0-1192.207~14.04.1 and related versions, as well as Ubuntu kernels prior to 6.14.0-29.29 and related variants. Google Kubernetes Engine (GKE) Standard clusters are impacted, while GKE Autopilot clusters are not impacted by default unless configured with seccomp Unconfined profile or CAP_NET_ADMIN capability. Red Hat has issued an important security advisory with patches available for kernel-rt packages, requiring a system reboot. Ubuntu has also released updated kernel packages to address this flaw. The CVSS v3.1 score is 7.8 (High), reflecting local attack vector with low complexity, requiring privileges, no user interaction, and high impact on confidentiality, integrity, and availability.
Potential Impact
Successful exploitation of this vulnerability could allow a local attacker with limited privileges to escalate their privileges on affected Container-Optimized OS nodes, potentially compromising system confidentiality, integrity, and availability. This impacts environments such as Red Hat Enterprise Linux 8 Real Time and Ubuntu kernels used in cloud and container orchestration platforms like GKE Standard clusters. GKE Autopilot clusters are generally not affected unless configured with insecure profiles. There are no known exploits in the wild at this time.
Mitigation Recommendations
A patch is available and should be applied promptly. Red Hat users should update to the kernel-rt packages version 4.18.0-553.75.1.rt7.416.el8_10 or later and reboot the system. Ubuntu users should upgrade to the specified fixed kernel versions (e.g., 6.14.0-29.29 or later) and reboot. For GKE users, upgrade Ubuntu node pools to the fixed versions listed (e.g., 1.28.15-gke.2697000 or later). GKE Autopilot clusters are not impacted by default but should avoid using seccomp Unconfined profile or allowing CAP_NET_ADMIN to reduce risk. No additional mitigations are required beyond applying the official patches and rebooting.
Linux azure: In the Linux kernel, the following vulnerability has been resolved: net/sched: Always pass notifications when child class becomes empty Certain… (CVE-2025-38350)
Description
CVE-2025-38350 is a high-severity vulnerability in the Linux kernel's network traffic control subsystem that can lead to privilege escalation on Container-Optimized OS nodes. It affects certain versions of Red Hat Enterprise Linux 8 Real Time kernels and Ubuntu Linux kernels, including those used in Google Kubernetes Engine (GKE) Standard clusters. GKE Autopilot clusters are not impacted by default but may be vulnerable if configured with certain profiles. The vulnerability has been addressed by patches released by Red Hat and Ubuntu, requiring system updates and reboots. Users should upgrade to the specified fixed kernel versions to mitigate the issue.
CVSS v3.1
Score 7.8high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2025-38350 is a vulnerability in the Linux kernel's net/sched subsystem where notifications were not always passed when a child class becomes empty, leading to potential privilege escalation on Container-Optimized OS nodes. This affects Red Hat Enterprise Linux 8 Real Time kernels prior to version 4.15.0-1192.207~14.04.1 and related versions, as well as Ubuntu kernels prior to 6.14.0-29.29 and related variants. Google Kubernetes Engine (GKE) Standard clusters are impacted, while GKE Autopilot clusters are not impacted by default unless configured with seccomp Unconfined profile or CAP_NET_ADMIN capability. Red Hat has issued an important security advisory with patches available for kernel-rt packages, requiring a system reboot. Ubuntu has also released updated kernel packages to address this flaw. The CVSS v3.1 score is 7.8 (High), reflecting local attack vector with low complexity, requiring privileges, no user interaction, and high impact on confidentiality, integrity, and availability.
Potential Impact
Successful exploitation of this vulnerability could allow a local attacker with limited privileges to escalate their privileges on affected Container-Optimized OS nodes, potentially compromising system confidentiality, integrity, and availability. This impacts environments such as Red Hat Enterprise Linux 8 Real Time and Ubuntu kernels used in cloud and container orchestration platforms like GKE Standard clusters. GKE Autopilot clusters are generally not affected unless configured with insecure profiles. There are no known exploits in the wild at this time.
Mitigation Recommendations
A patch is available and should be applied promptly. Red Hat users should update to the kernel-rt packages version 4.18.0-553.75.1.rt7.416.el8_10 or later and reboot the system. Ubuntu users should upgrade to the specified fixed kernel versions (e.g., 6.14.0-29.29 or later) and reboot. For GKE users, upgrade Ubuntu node pools to the fixed versions listed (e.g., 1.28.15-gke.2697000 or later). GKE Autopilot clusters are not impacted by default but should avoid using seccomp Unconfined profile or allowing CAP_NET_ADMIN to reduce risk. No additional mitigations are required beyond applying the official patches and rebooting.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2025:15786
- Cve Count
- 3
- Additional Cves
- ["CVE-2025-38392","CVE-2025-38449"]
Threat ID: 6a3da1e44853345fc182cf66
Added to database: 06/25/2026, 21:47:16 UTC
Last enriched: 08/04/2026, 13:24:59 UTC
Last updated: 09/10/2026, 19:36:50 UTC
Views: 49
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.