Security readout for executives and security teams
Plain-English summary
A race condition in the Linux taprio network scheduler can access memory after it has been freed. A successful local attack could potentially crash the system or compromise confidentiality and integrity. The supplied CVSS score is 7.8, but practical risk depends on whether taprio is present and reachable.
Executive priority
Treat this as a high-priority kernel maintenance issue for systems using taprio or allowing less-trusted local access. Patch through supported vendor channels after compatibility testing. Broader emergency action is not supported by the supplied evidence because active exploitation is unconfirmed and exposure prerequisites remain incomplete.
Technical view
taprio_dev_notifier() lacked an RCU read-side critical section. Concurrent execution with advance_sched() could therefore cause a use-after-free. The upstream correction adds rcu_read_lock() protection. The supplied data identifies multiple stable-kernel correction commits, but its affected-version listing is ambiguous and should not be treated as a precise range.
Likely exposure
Exposure is most likely on Linux systems using the taprio traffic-control scheduler and running a build without the correction. The CVSS vector indicates local access and low privileges are required, with no user interaction. Exact configuration prerequisites and affected version boundaries are not established by the supplied sources.
Exploitation context
CISA KEV status is false, and the supplied sources provide no evidence of exploitation in the wild or a public exploit. Theoretical impact is substantial because the CVSS assessment assigns high confidentiality, integrity, and availability effects. Practical exploitability is not documented in this bundle.
Researcher notes
The defect is a race between taprio_dev_notifier() and advance_sched(), resolved by adding RCU read-side protection. The bundle names four stable commits but supplies duplicated commit-like version entries and an unclear affected-version array. Researchers should derive branch-specific vulnerable and fixed boundaries from the referenced commits and vendor backport records.
Mitigation direction
- Install a vendor-supported kernel containing the applicable stable-kernel correction.
- Check distribution or appliance vendor guidance for exact fixed package versions.
- Prioritize systems using taprio or exposing local access to less-trusted users.
- If immediate patching is unavailable, evaluate disabling unnecessary taprio use with operational owners.
Validation and detection
- Inventory Linux kernel versions and vendor package revisions across potentially exposed systems.
- Verify the running kernel includes the applicable referenced correction commit or vendor backport.
- Determine whether taprio is configured or required on each system.
- Confirm patched systems rebooted into the corrected kernel, not merely installed it.
- Review vendor advisories because the supplied affected-version data is ambiguous.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-38087 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/8c5713ce1ced75f9e9ed5c642ea3d2ba06ead69cCVE reference, Linux
- https://git.kernel.org/stable/c/8a008c89e5e5c5332e4c0a33d707db9ddd529f8aCVE reference, Linux
- https://git.kernel.org/stable/c/b1547d28ba468bc3b88764efd13e4319bab63be8CVE reference, Linux
- https://git.kernel.org/stable/c/b160766e26d4e2e2d6fe2294e0b02f92baefcec5CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.