CVE-2025-38468

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree

htb_lookup_leaf has a BUG_ON that can trigger with the following:

tc qdisc del dev lo root

tc qdisc add dev lo root handle 1: htb default 1

tc class add dev lo parent 1: classid 1:1 htb rate 64bit

tc qdisc add dev lo parent 1:1 handle 2: netem

tc qdisc add dev lo parent 2:1 handle 3: blackhole

ping -I lo -c1 -W0.001 127.0.0.1

The root cause is the following:

1. htb_dequeue calls htb_dequeue_tree which calls the dequeue handler on

the selected leaf qdisc

2. netem_dequeue calls enqueue on the child qdisc

3. blackhole_enqueue drops the packet and returns a value that is not

just NET_XMIT_SUCCESS

4. Because of this, netem_dequeue calls qdisc_tree_reduce_backlog, and

since qlen is now 0, it calls htb_qlen_notify -> htb_deactivate ->

htb_deactiviate_prios -> htb_remove_class_from_row -> htb_safe_rb_erase

5. As this is the only class in th

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References