Junglewise Threat Intelligence

CVE-2025-38553: Linux Kernel denial of service in netem qdisc

CVE-2025-38553 · Severity: info · CVSS 6.2 · Published 2025-08-19

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's networking subsystem can allow a local user to crash the system or cause it to stop responding. The issue occurs when specific network emulation settings are combined in a way that creates an infinite loop, exhausting system memory and processing power. This could lead to a total service outage for the affected server.

Technical details

A vulnerability in the Linux kernel's Network Emulator (netem) qdisc component allows for a denial of service. The root cause is a failure in the duplication prevention logic when multiple netem instances reside within the same qdisc tree. An attacker with local privileges to configure network scheduling can trigger a soft lockup and an Out-Of-Memory (OOM) loop during packet dequeue operations. The fix restricts the conditions for adding duplicating netems to a qdisc tree, ensuring they cannot coexist in a way that triggers recursion or infinite loops. Patches have been released across multiple stable kernel branches.

Affected products

  • Linux Linux Kernel 2.6.13 to 5.4.297, 5.5 to 5.10.241, 5.11 to 5.15.190, 5.16 to 6.1.148, 6.2 to 6.6.102, 6.7 to 6.12.42, 6.13 to 6.15.10, 6.16 to 6.16.1

Timeline

  • 2025-08-19: disclosed
  • 2025-08-19: advisory