CVE-2025-38684

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net/sched: ets: use old 'nbands' while purging unused classes

Shuang reported sch_ets test-case [1] crashing in ets_class_qlen_notify()

after recent changes from Lion [2]. The problem is: in ets_qdisc_change()

we purge unused DWRR queues; the value of 'q->nbands' is the new one, and

the cleanup should be done with the old one. The problem is here since my

first attempts to fix ets_qdisc_change(), but it surfaced again after the

recent qdisc len accounting fixes. Fix it purging idle DWRR queues before

assigning a new value of 'q->nbands', so that all purge operations find a

consistent configuration:

- old 'q->nbands' because it's needed by ets_class_find()

- old 'q->nstrict' because it's needed by ets_class_is_strict()

BUG: kernel NULL pointer dereference, address: 0000000000000000

#PF: supervisor read access in kernel mode

#PF: error_code(0x0000) - not-present page

PGD 0 P4D 0

Oops: Oops: 0000 [#1] SMP NOPTI

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References