Junglewise Threat Intelligence

CVE-2025-38457: Linux Kernel null pointer dereference in net/sched qdisc API

CVE-2025-38457 · Severity: medium · CVSS 5.5 · Published 2025-07-25

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's networking subsystem could allow a local user to crash the system. The issue exists in the traffic control (tc) component, which manages how network data is prioritized and scheduled. By providing invalid configuration parameters when setting up network queuing disciplines, an attacker can trigger a system failure, leading to a denial of service.

Technical details

A vulnerability exists in the Linux kernel's qdisc API within net/sched/sch_api.c. When a user creates or modifies a qdisc and specifies a parent that is not a class, the API fails to validate the existence of the parent class before executing the qdisc's initialization callback. Certain qdiscs (such as fq, hhf, and choke) unconditionally call qdisc_tree_reduce_backlog() during initialization, which eventually invokes qlen_notify with a NULL class pointer. This results in a null pointer dereference and a kernel oops. The fix involves updating qdisc_leaf() to return an error pointer if the parent class is not found, allowing __tc_modify_qdisc to abort before qdisc_create is called. This issue is reachable via local tools like 'tc' and requires CAP_NET_ADMIN or equivalent privileges.

Affected products

  • Linux Linux Kernel 2.6.20 to 5.4.296, 5.5 to 5.10.240, 5.11 to 5.15.189, 5.16 to 6.1.146, 6.2 to 6.6.99, 6.7 to 6.12.39, 6.13 to 6.15.7, 6.16-rc1 to 6.16-rc5

Timeline

  • 2025-07-07: patched: Initial patch submitted to netdev
  • 2025-07-25: disclosed: Vulnerability published

References

Related threats