Skip to content
Heist/ feed
High

sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue()

Type: advisorySource: Official CVE List1 source record

In the Linux kernel, the following vulnerability has been resolved: sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() When enqueuing the first packet to an HFSC class, hfsc_enqueue() calls the child qdisc's peek() operation before incrementing sch->q.qlen and sch->qstats.backlog. If the child qdisc uses qdisc_peek_dequeued(), this may trigger an immediate dequeue and potential packet drop. In such cases, qdisc_tree_reduce_backlog() is called, but the HFSC qdisc's qlen and backlog have not yet been updated, leading to inconsistent queue accounting. This can leave an empty HFSC class in the active list, causing further consequences like use-after-free. This patch fixes the bug by moving the increment of sch->q.qlen and sch->qstats.backlog before the call to the child qdisc's peek() operation. This ensures that queue length and backlog are always accurate when packet drops or dequeues are triggered during the peek.

Announced Source revision 1
Original source ↗

CVE-2025-38000

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2025-38000

Linux

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Linux

Source reference: /containers/cna/affected/1/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "12d0ad3be9c3854e52ec74bb83bb6f43612827c7",
        "lessThan": "1034e3310752e8675e313f7271b348914008719a",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "12d0ad3be9c3854e52ec74bb83bb6f43612827c7",
        "lessThan": "f9f593e34d2fb67644372c8f7b033bdc622ad228",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "12d0ad3be9c3854e52ec74bb83bb6f43612827c7",
        "lessThan": "89c301e929a0db14ebd94b4d97764ce1d6981653",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "12d0ad3be9c3854e52ec74bb83bb6f43612827c7",
        "lessThan": "f1dde3eb17dc1b8bd07aed00004b1e05fc87a3d4",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "12d0ad3be9c3854e52ec74bb83bb6f43612827c7",
        "lessThan": "93c276942e75de0e5bc91576300d292e968f5a02",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "12d0ad3be9c3854e52ec74bb83bb6f43612827c7",
        "lessThan": "49b21795b8e5654a7df3d910a12e1060da4c04cf",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "12d0ad3be9c3854e52ec74bb83bb6f43612827c7",
        "lessThan": "3f3a22eebbc32b4fa8ce9c1d5f9db214b45b9335",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "12d0ad3be9c3854e52ec74bb83bb6f43612827c7",
        "lessThan": "3f981138109f63232a5fb7165938d4c945cc1b9d",
        "versionType": "git"
      }
    ],
    "programFiles": [
      "net/sched/sch_hfsc.c"
    ],
    "defaultStatus": "unaffected"
  },
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "4.8"
      },
      {
        "status": "unaffected",
        "version": "0",
        "lessThan": "4.8",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "5.4.294",
        "versionType": "semver",
        "lessThanOrEqual": "5.4.*"
      },
      {
        "status": "unaffected",
        "version": "5.10.238",
        "versionType": "semver",
        "lessThanOrEqual": "5.10.*"
      },
      {
        "status": "unaffected",
        "version": "5.15.185",
        "versionType": "semver",
        "lessThanOrEqual": "5.15.*"
      },
      {
        "status": "unaffected",
        "version": "6.1.141",
        "versionType": "semver",
        "lessThanOrEqual": "6.1.*"
      },
      {
        "status": "unaffected",
        "version": "6.6.93",
        "versionType": "semver",
        "lessThanOrEqual": "6.6.*"
      },
      {
        "status": "unaffected",
        "version": "6.12.31",
        "versionType": "semver",
        "lessThanOrEqual": "6.12.*"
      },
      {
        "status": "unaffected",
        "version": "6.14.9",
        "versionType": "semver",
        "lessThanOrEqual": "6.14.*"
      },
      {
        "status": "unaffected",
        "version": "6.15",
        "versionType": "original_commit_for_fix",
        "lessThanOrEqual": "*"
      }
    ],
    "programFiles": [
      "net/sched/sch_hfsc.c"
    ],
    "defaultStatus": "affected"
  }
]
Related CVEs
CVE-2025-38000

Source reference: /cveMetadata/cveId

Publisher severity

high

Source reference: /containers/cna/metrics

Event
#30506 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement