{"id":"CVE-2025-38000","revision":"35698d83c47b44a29660adfce70c7340","records":[{"revision":"35698d83c47b44a29660adfce70c7340","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2025-38000","aliases":[],"title":"sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nsch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue()\n\nWhen enqueuing the first packet to an HFSC class, hfsc_enqueue() calls the\nchild qdisc's peek() operation before incrementing sch->q.qlen and\nsch->qstats.backlog. If the child qdisc uses qdisc_peek_dequeued(), this may\ntrigger an immediate dequeue and potential packet drop. In such cases,\nqdisc_tree_reduce_backlog() is called, but the HFSC qdisc's qlen and backlog\nhave not yet been updated, leading to inconsistent queue accounting. This\ncan leave an empty HFSC class in the active list, causing further\nconsequences like use-after-free.\n\nThis patch fixes the bug by moving the increment of sch->q.qlen and\nsch->qstats.backlog before the call to the child qdisc's peek() operation.\nThis ensures that queue length and backlog are always accurate when packet\ndrops or dequeues are triggered during the peek.","state":0,"publishedAt":"2025-06-06T13:03:35.405+00:00","modifiedAt":"2026-10-15T21:52:06.159+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/sched/sch_hfsc.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"12d0ad3be9c3854e52ec74bb83bb6f43612827c7\",\n                            \"lessThan\": \"1034e3310752e8675e313f7271b348914008719a\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"12d0ad3be9c3854e52ec74bb83bb6f43612827c7\",\n                            \"lessThan\": \"f9f593e34d2fb67644372c8f7b033bdc622ad228\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"12d0ad3be9c3854e52ec74bb83bb6f43612827c7\",\n                            \"lessThan\": \"89c301e929a0db14ebd94b4d97764ce1d6981653\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"12d0ad3be9c3854e52ec74bb83bb6f43612827c7\",\n                            \"lessThan\": \"f1dde3eb17dc1b8bd07aed00004b1e05fc87a3d4\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"12d0ad3be9c3854e52ec74bb83bb6f43612827c7\",\n                            \"lessThan\": \"93c276942e75de0e5bc91576300d292e968f5a02\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"12d0ad3be9c3854e52ec74bb83bb6f43612827c7\",\n                            \"lessThan\": \"49b21795b8e5654a7df3d910a12e1060da4c04cf\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"12d0ad3be9c3854e52ec74bb83bb6f43612827c7\",\n                            \"lessThan\": \"3f3a22eebbc32b4fa8ce9c1d5f9db214b45b9335\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"12d0ad3be9c3854e52ec74bb83bb6f43612827c7\",\n                            \"lessThan\": \"3f981138109f63232a5fb7165938d4c945cc1b9d\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/sched/sch_hfsc.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"4.8\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"4.8\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.4.294\",\n                            \"lessThanOrEqual\": \"5.4.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.238\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.185\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.141\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.93\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.31\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.14.9\",\n                            \"lessThanOrEqual\": \"6.14.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.15\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/1034e3310752e8675e313f7271b348914008719a","https://git.kernel.org/stable/c/f9f593e34d2fb67644372c8f7b033bdc622ad228","https://git.kernel.org/stable/c/89c301e929a0db14ebd94b4d97764ce1d6981653","https://git.kernel.org/stable/c/f1dde3eb17dc1b8bd07aed00004b1e05fc87a3d4","https://git.kernel.org/stable/c/93c276942e75de0e5bc91576300d292e968f5a02","https://git.kernel.org/stable/c/49b21795b8e5654a7df3d910a12e1060da4c04cf","https://git.kernel.org/stable/c/3f3a22eebbc32b4fa8ce9c1d5f9db214b45b9335","https://git.kernel.org/stable/c/3f981138109f63232a5fb7165938d4c945cc1b9d"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-38000","license":"CVE Program Terms of Use","key":"cve-program:CVE-2025-38000","identifiers":["CVE-2025-38000"]},"retained":false,"historicalAffected":[]}],"coverage":[]}