{"id":"CVE-2025-38115","state":"PUBLISHED","title":"net_sched: sch_sfq: fix a potential crash on gso_skb handling","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet_sched: sch_sfq: fix a potential crash on gso_skb handling\n\nSFQ has an assumption of always being able to queue at least one packet.\n\nHowever, after the blamed commit, sch->q.len can be inflated by packets\nin sch->gso_skb, and an enqueue() on an empty SFQ qdisc can be followed\nby an immediate drop.\n\nFix sfq_drop() to properly clear q->tail in this situation.\n\n\nip netns add lb\nip link add dev to-lb type veth peer name in-lb netns lb\nethtool -K to-lb tso off                 # force qdisc to requeue gso_skb\nip netns exec lb ethtool -K in-lb gro on # enable NAPI\nip link set dev to-lb up\nip -netns lb link set dev in-lb up\nip addr add dev to-lb 192.168.20.1/24\nip -netns lb addr add dev in-lb 192.168.20.2/24\ntc qdisc replace dev to-lb root sfq limit 100\n\nip netns exec lb netserver\n\nnetperf -H 192.168.20.2 -l 100 &\nnetperf -H 192.168.20.2 -l 100 &\nnetperf -H 192.168.20.2 -l 100 &\nnetperf -H 192.168.20.2 -l 100 &","publishedAt":"2025-07-03T08:35:23.750Z","updatedAt":"2026-10-15T21:52:08.900Z","severity":{"score":7.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"a53851e2c3218aa30b77abd6e68cf1c371f15afe","status":"affected","lessThan":"c337efb20d6d9f9bbb4746f6b119917af5c886dc","versionType":"git"},{"version":"a53851e2c3218aa30b77abd6e68cf1c371f15afe","status":"affected","lessThan":"b44f791f27b14c9eb6b907fbe51f2ba8bec32085","versionType":"git"},{"version":"a53851e2c3218aa30b77abd6e68cf1c371f15afe","status":"affected","lessThan":"5814a7fc3abb41f63f2d44c9d3ff9d4e62965b72","versionType":"git"},{"version":"a53851e2c3218aa30b77abd6e68cf1c371f15afe","status":"affected","lessThan":"9c19498bdd7cb9d854bd3c54260f71cf7408495e","versionType":"git"},{"version":"a53851e2c3218aa30b77abd6e68cf1c371f15afe","status":"affected","lessThan":"b4e9bab6011b9559b7c157b16b91ae46d4d8c533","versionType":"git"},{"version":"a53851e2c3218aa30b77abd6e68cf1c371f15afe","status":"affected","lessThan":"d1bc80da75c789f2f6830df89d91fb2f7a509943","versionType":"git"},{"version":"a53851e2c3218aa30b77abd6e68cf1c371f15afe","status":"affected","lessThan":"82448d4dcd8406dec688632a405fdcf7f170ec69","versionType":"git"},{"version":"a53851e2c3218aa30b77abd6e68cf1c371f15afe","status":"affected","lessThan":"82ffbe7776d0ac084031f114167712269bf3d832","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/sched/sch_sfq.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"4.16","status":"affected"},{"version":"0","status":"unaffected","lessThan":"4.16","versionType":"semver"},{"version":"5.4.295","status":"unaffected","lessThanOrEqual":"5.4.*","versionType":"semver"},{"version":"5.10.239","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.186","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.142","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.94","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.34","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.15.3","status":"unaffected","lessThanOrEqual":"6.15.*","versionType":"semver"},{"version":"6.16","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/sched/sch_sfq.c"]}],"references":["https://git.kernel.org/stable/c/c337efb20d6d9f9bbb4746f6b119917af5c886dc","https://git.kernel.org/stable/c/b44f791f27b14c9eb6b907fbe51f2ba8bec32085","https://git.kernel.org/stable/c/5814a7fc3abb41f63f2d44c9d3ff9d4e62965b72","https://git.kernel.org/stable/c/9c19498bdd7cb9d854bd3c54260f71cf7408495e","https://git.kernel.org/stable/c/b4e9bab6011b9559b7c157b16b91ae46d4d8c533","https://git.kernel.org/stable/c/d1bc80da75c789f2f6830df89d91fb2f7a509943","https://git.kernel.org/stable/c/82448d4dcd8406dec688632a405fdcf7f170ec69","https://git.kernel.org/stable/c/82ffbe7776d0ac084031f114167712269bf3d832","https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html","https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"],"weaknesses":[],"ingestedAt":"2026-10-29T20:09:09.358Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/38xxx/CVE-2025-38115.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-38115","state":"PUBLISHED","datePublished":"2025-07-03T08:35:23.750Z","dateUpdated":"2026-10-15T21:52:08.900Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2025-04-16T04:51:23.986Z"},"containers":{"cna":{"title":"net_sched: sch_sfq: fix a potential crash on gso_skb handling","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet_sched: sch_sfq: fix a potential crash on gso_skb handling\n\nSFQ has an assumption of always being able to queue at least one packet.\n\nHowever, after the blamed commit, sch->q.len can be inflated by packets\nin sch->gso_skb, and an enqueue() on an empty SFQ qdisc can be followed\nby an immediate drop.\n\nFix sfq_drop() to properly clear q->tail in this situation.\n\n\nip netns add lb\nip link add dev to-lb type veth peer name in-lb netns lb\nethtool -K to-lb tso off                 # force qdisc to requeue gso_skb\nip netns exec lb ethtool -K in-lb gro on # enable NAPI\nip link set dev to-lb up\nip -netns lb link set dev in-lb up\nip addr add dev to-lb 192.168.20.1/24\nip -netns lb addr add dev in-lb 192.168.20.2/24\ntc qdisc replace dev to-lb root sfq limit 100\n\nip netns exec lb netserver\n\nnetperf -H 192.168.20.2 -l 100 &\nnetperf -H 192.168.20.2 -l 100 &\nnetperf -H 192.168.20.2 -l 100 &\nnetperf -H 192.168.20.2 -l 100 &"}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"a53851e2c3218aa30b77abd6e68cf1c371f15afe","status":"affected","lessThan":"c337efb20d6d9f9bbb4746f6b119917af5c886dc","versionType":"git"},{"version":"a53851e2c3218aa30b77abd6e68cf1c371f15afe","status":"affected","lessThan":"b44f791f27b14c9eb6b907fbe51f2ba8bec32085","versionType":"git"},{"version":"a53851e2c3218aa30b77abd6e68cf1c371f15afe","status":"affected","lessThan":"5814a7fc3abb41f63f2d44c9d3ff9d4e62965b72","versionType":"git"},{"version":"a53851e2c3218aa30b77abd6e68cf1c371f15afe","status":"affected","lessThan":"9c19498bdd7cb9d854bd3c54260f71cf7408495e","versionType":"git"},{"version":"a53851e2c3218aa30b77abd6e68cf1c371f15afe","status":"affected","lessThan":"b4e9bab6011b9559b7c157b16b91ae46d4d8c533","versionType":"git"},{"version":"a53851e2c3218aa30b77abd6e68cf1c371f15afe","status":"affected","lessThan":"d1bc80da75c789f2f6830df89d91fb2f7a509943","versionType":"git"},{"version":"a53851e2c3218aa30b77abd6e68cf1c371f15afe","status":"affected","lessThan":"82448d4dcd8406dec688632a405fdcf7f170ec69","versionType":"git"},{"version":"a53851e2c3218aa30b77abd6e68cf1c371f15afe","status":"affected","lessThan":"82ffbe7776d0ac084031f114167712269bf3d832","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/sched/sch_sfq.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"4.16","status":"affected"},{"version":"0","status":"unaffected","lessThan":"4.16","versionType":"semver"},{"version":"5.4.295","status":"unaffected","lessThanOrEqual":"5.4.*","versionType":"semver"},{"version":"5.10.239","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.186","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.142","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.94","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.34","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.15.3","status":"unaffected","lessThanOrEqual":"6.15.*","versionType":"semver"},{"version":"6.16","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/sched/sch_sfq.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/c337efb20d6d9f9bbb4746f6b119917af5c886dc"},{"url":"https://git.kernel.org/stable/c/b44f791f27b14c9eb6b907fbe51f2ba8bec32085"},{"url":"https://git.kernel.org/stable/c/5814a7fc3abb41f63f2d44c9d3ff9d4e62965b72"},{"url":"https://git.kernel.org/stable/c/9c19498bdd7cb9d854bd3c54260f71cf7408495e"},{"url":"https://git.kernel.org/stable/c/b4e9bab6011b9559b7c157b16b91ae46d4d8c533"},{"url":"https://git.kernel.org/stable/c/d1bc80da75c789f2f6830df89d91fb2f7a509943"},{"url":"https://git.kernel.org/stable/c/82448d4dcd8406dec688632a405fdcf7f170ec69"},{"url":"https://git.kernel.org/stable/c/82ffbe7776d0ac084031f114167712269bf3d832"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable code is the SFQ qdisc, reached by configuring a qdisc via tc/netlink on a local netdevice and then driving local transmit traffic through it; there is no path for an unauthenticated remote peer to install the qdisc or control the requeue/limit conditions. Per kernel scoring convention, tc/qdisc netlink-configured subsystems are Local.\nAC:L - The attacker controls every precondition — SFQ limit, the veth/NAPI setup that forces NETDEV_TX_BUSY requeues into gso_skb, the number of flows, and the traffic rate — so the \"empty SFQ + inflated q.qlen + single-slot drop\" state is reached deterministically, as demonstrated by the upstream reproducer. No race window or uncontrollable memory layout is required.\nPR:L - Creating the veth pair and installing the SFQ qdisc requires only CAP_NET_ADMIN within a network namespace, which any unprivileged local user obtains via `unshare -Urn`; no real root in the init namespace is needed. Basic local user access is therefore sufficient.\nUI:N - The attacker sets up the qdisc and generates the traffic entirely on their own; no victim action, mount, or file open is involved.\nS:U - The corruption occurs in kernel memory and the resulting compromise stays within the same security authority (kernel/host); no VM, IOMMU, or hypervisor boundary is crossed.\nC:H - The stale q->tail leads to slot->qlen underflowing to 65535, causing sfq_link() to read q->dep[65535] roughly 256 KB out of bounds, and the emptied slot is returned as a fake sk_buff whose contents are read as skb->len/skb->data/GSO fields by the transmit path — both yield disclosure of adjacent kernel memory and, via heap grooming, arbitrary read.\nI:H - sfq_link() performs out-of-bounds writes (`q->dep[65535].next = x` and `sfq_dep_head(q, n)->prev = x` with n taken from out-of-bounds memory), and the type-confused sfq_slot is ultimately freed into skbuff_head_cache — an OOB write plus wild free that is leverageable for control-flow hijack and privilege escalation.\nA:H - Dequeuing from the stale empty slot reliably produces a bogus sk_buff handed to the device driver plus out-of-bounds accesses, causing kernel oops/panic (the reported symptom is a crash), and the condition can be re-triggered at will."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-05T11:59:39.505Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.16","versionEndExcluding":"5.4.295"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.16","versionEndExcluding":"5.10.239"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.16","versionEndExcluding":"5.15.186"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.16","versionEndExcluding":"6.1.142"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.16","versionEndExcluding":"6.6.94"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.16","versionEndExcluding":"6.12.34"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.16","versionEndExcluding":"6.15.3"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.16","versionEndExcluding":"6.16"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"},{"url":"https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2025-11-03T17:34:18.395Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2025-38115","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-15T21:47:38.082535Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-15T21:52:08.900Z"}}]}}}