Junglewise Threat Intelligence

CVE-2025-38350: Linux Kernel use-after-free in net/sched qdisc_tree_reduce_backlog

CVE-2025-38350 · Severity: high · CVSS 7.8 · Published 2025-07-19

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's networking subsystem could allow a local user to crash the system or potentially execute unauthorized code. The issue occurs in the traffic control component, which manages how network data is prioritized and sent. By manipulating specific network queuing rules, an attacker can trigger a memory error that leads to system instability or a security breach.

Technical details

A use-after-free (UAF) vulnerability exists in the Linux kernel's traffic control (tc) subsystem due to improper backlog accounting in classful queuing disciplines (qdiscs). Certain qdiscs may invoke a dequeue handler during an enqueue operation, unexpectedly emptying a child qdisc and triggering a qlen_notify() call. If the parent qdisc does not expect this state change, it may later attempt to access the class via a stale pointer. The vulnerability is reachable via local 'tc' commands to configure specific qdisc hierarchies (e.g., DRR, HFSC, and netem). The fix ensures that qdisc_tree_reduce_backlog always notifies the parent when a child becomes empty, preventing the use of stale class pointers.

Affected products

  • Linux Linux Kernel 5.4.294 to 5.4.296, 5.10.238 to 5.10.240, 5.15.185 to 5.15.187, 6.1.141 to 6.1.144, 6.6.93 to 6.6.97, 6.12.31 to 6.12.37, 6.14.9 to 6.15, 6.15.1 to 6.15.6, 6.16-rc1 to 6.16-rc4

Timeline

  • 2025-06-30: patched: Initial patch submitted by Lion Ackermann
  • 2025-07-19: advisory: CVE-2025-38350 published

References

Related threats