Linux azure: In the Linux kernel, the following vulnerability has been resolved: sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() When… (CVE-2025-38000)
In the Linux kernel, the following vulnerability has been resolved: sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() When enqueuing the first packet to an HFSC class, hfsc_enqueue() calls the child qdisc's peek() operation before incrementing sch->q.qlen and sch->qstats.backlog. If the child qdisc uses qdisc_peek_dequeued(), this may trigger an immediate dequeue and potential packet drop. In such cases, qdisc_tree_reduce_backlog() is called, but the HFSC qdisc's qlen and backlog have not yet been updated, leading to inconsistent queue accounting. This can leave an empty HFSC class in the active list, causing further consequences like use-after-free. This patch fixes the bug by moving the increment of sch->q.qlen and sch->qstats.backlog before the call to the child qdisc's peek() operation. This ensures that queue length and backlog are always accurate when packet drops or dequeues are triggered during the peek.
AI Analysis
Technical Summary
The Red Hat security advisory RHSA-2025:14413 reports fixes for three kernel vulnerabilities: CVE-2025-38000 fixes a queue length accounting bug in sch_hfsc's hfsc_enqueue() when using peek; CVE-2025-38177 makes hfsc_qlen_notify() idempotent to prevent inconsistent state; and CVE-2025-38350 ensures notifications are always passed when a child class becomes empty in net/sched. These vulnerabilities affect the Linux kernel packages in Red Hat Enterprise Linux 7.7. The advisory provides updated kernel packages to remediate these issues, requiring a system reboot for the changes to take effect.
Potential Impact
The vulnerabilities impact the Linux kernel's traffic control scheduling components, potentially causing incorrect queue length accounting and notification handling. While the exact exploitation impact is not detailed, Red Hat rates the security impact as Important, indicating these issues could affect system stability or security. There are no known exploits in the wild at this time.
Mitigation Recommendations
Red Hat has released updated kernel packages that address these vulnerabilities. Users should apply the kernel update for Red Hat Enterprise Linux 7.7 as described in the advisory RHSA-2025:14413 and reboot the system to complete the remediation. Patch status is confirmed by the vendor advisory. No additional mitigation steps are indicated.
Linux azure: In the Linux kernel, the following vulnerability has been resolved: sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() When… (CVE-2025-38000)
Description
In the Linux kernel, the following vulnerability has been resolved: sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() When enqueuing the first packet to an HFSC class, hfsc_enqueue() calls the child qdisc's peek() operation before incrementing sch->q.qlen and sch->qstats.backlog. If the child qdisc uses qdisc_peek_dequeued(), this may trigger an immediate dequeue and potential packet drop. In such cases, qdisc_tree_reduce_backlog() is called, but the HFSC qdisc's qlen and backlog have not yet been updated, leading to inconsistent queue accounting. This can leave an empty HFSC class in the active list, causing further consequences like use-after-free. This patch fixes the bug by moving the increment of sch->q.qlen and sch->qstats.backlog before the call to the child qdisc's peek() operation. This ensures that queue length and backlog are always accurate when packet drops or dequeues are triggered during the peek.
CVSS v3.1
Score 7.8high
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Red Hat security advisory RHSA-2025:14413 reports fixes for three kernel vulnerabilities: CVE-2025-38000 fixes a queue length accounting bug in sch_hfsc's hfsc_enqueue() when using peek; CVE-2025-38177 makes hfsc_qlen_notify() idempotent to prevent inconsistent state; and CVE-2025-38350 ensures notifications are always passed when a child class becomes empty in net/sched. These vulnerabilities affect the Linux kernel packages in Red Hat Enterprise Linux 7.7. The advisory provides updated kernel packages to remediate these issues, requiring a system reboot for the changes to take effect.
Potential Impact
The vulnerabilities impact the Linux kernel's traffic control scheduling components, potentially causing incorrect queue length accounting and notification handling. While the exact exploitation impact is not detailed, Red Hat rates the security impact as Important, indicating these issues could affect system stability or security. There are no known exploits in the wild at this time.
Mitigation Recommendations
Red Hat has released updated kernel packages that address these vulnerabilities. Users should apply the kernel update for Red Hat Enterprise Linux 7.7 as described in the advisory RHSA-2025:14413 and reboot the system to complete the remediation. Patch status is confirmed by the vendor advisory. No additional mitigation steps are indicated.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2025:14413
- Cve Count
- 3
- Additional Cves
- ["CVE-2025-38177","CVE-2025-38350"]
Threat ID: 6a3caf124853345fc153d7c7
Added to database: 06/25/2026, 04:31:14 UTC
Last enriched: 06/25/2026, 04:45:52 UTC
Last updated: 09/10/2026, 19:24:56 UTC
Views: 122
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.