CVE-2025-38457

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net/sched: Abort __tc_modify_qdisc if parent class does not exist

Lion's patch [1] revealed an ancient bug in the qdisc API.

Whenever a user creates/modifies a qdisc specifying as a parent another

qdisc, the qdisc API will, during grafting, detect that the user is

not trying to attach to a class and reject. However grafting is

performed after qdisc_create (and thus the qdiscs' init callback) is

executed. In qdiscs that eventually call qdisc_tree_reduce_backlog

during init or change (such as fq, hhf, choke, etc), an issue

arises. For example, executing the following commands:

sudo tc qdisc add dev lo root handle a: htb default 2

sudo tc qdisc add dev lo parent a: handle beef fq

Qdiscs such as fq, hhf, choke, etc unconditionally invoke

qdisc_tree_reduce_backlog() in their control path init() or change() which

then causes a failure to find the child class; however, that does not stop

the unconditional invocation of th

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References