Security readout for executives and security teams
Plain-English summary
A Linux traffic-scheduling accounting error can leave an empty HFSC queue marked active, potentially causing use-after-free and compromising confidentiality, integrity, or availability. Exploitation requires local, low-privileged access according to the supplied CVSS vector, so this is serious but not described as remotely exploitable.
Executive priority
Address promptly, prioritizing systems with untrusted local users and confirmed HFSC use. Internet exposure alone does not establish reachability because the supplied assessment is local. Require owners to verify vendor-fixed kernel packages rather than relying only on upstream version strings.
Technical view
In hfsc_enqueue(), queue length and backlog were updated after invoking a child qdisc's peek operation. If that operation immediately dequeued or dropped a packet, backlog reduction occurred against stale accounting. The resulting inconsistent HFSC state could retain an empty class in the active list and lead to use-after-free. Stable kernel commits reorder accounting before peek.
Likely exposure
Exposure is limited to Linux systems containing the affected code and using the HFSC queueing discipline in a triggering configuration. The supplied data identifies affected kernel versions but does not clearly define normalized fixed ranges for every maintained branch. Confirm exposure against distribution-specific kernel advisories and build provenance.
Exploitation context
The supplied CVSS 3.1 score is 7.8 with local attack vector, low complexity, low privileges, and no user interaction. The bundle marks KEV false and provides no cited evidence of active exploitation, public weaponization, or remote reachability. Treat exploitation status as unconfirmed.
Researcher notes
The failure involves stale qlen and backlog accounting during a re-entrant dequeue or drop initiated by peek. The documented consequence is an empty class remaining active, with possible use-after-free. No CWE is supplied. Exact exploitability prerequisites, affected branch boundaries, and demonstrated impact are not established by the bundle.
Mitigation direction
- Install the vendor or distribution kernel update containing the referenced stable fix.
- Reboot into the updated kernel when required by the distribution's maintenance procedure.
- Check Linux distribution advisories for the corrected package version applicable to each system.
- Restrict unnecessary local account access while affected kernels remain deployed.
- Review whether HFSC is operationally required and consult vendor guidance before changing traffic-control configurations.
Validation and detection
- Inventory running kernel versions and map them to distribution security advisories.
- Determine which systems use the HFSC queueing discipline.
- Verify installed kernel packages contain an applicable referenced stable commit or vendor backport.
- Confirm systems booted into the corrected kernel after maintenance.
- Monitor kernel logs and stability telemetry for unexplained traffic-control or memory-related failures.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-38000 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/1034e3310752e8675e313f7271b348914008719aCVE reference, Linux
- https://git.kernel.org/stable/c/f9f593e34d2fb67644372c8f7b033bdc622ad228CVE reference, Linux
- https://git.kernel.org/stable/c/89c301e929a0db14ebd94b4d97764ce1d6981653CVE reference, Linux
- https://git.kernel.org/stable/c/f1dde3eb17dc1b8bd07aed00004b1e05fc87a3d4CVE reference, Linux
- https://git.kernel.org/stable/c/93c276942e75de0e5bc91576300d292e968f5a02CVE reference, Linux
- https://git.kernel.org/stable/c/49b21795b8e5654a7df3d910a12e1060da4c04cfCVE reference, Linux
- https://git.kernel.org/stable/c/3f3a22eebbc32b4fa8ce9c1d5f9db214b45b9335CVE reference, Linux
- https://git.kernel.org/stable/c/3f981138109f63232a5fb7165938d4c945cc1b9dCVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.htmlCVE reference, CVE
- https://lists.debian.org/debian-lts-announce/2025/10/msg00007.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.