LiveActive security incident?Get immediate response
CVE Record

CVE-2025-38637: net_sched: skbprio: Remove overly strict queue assertions

In the Linux kernel, the following vulnerability has been resolved: net_sched: skbprio: Remove overly strict queue assertions In the current implementation, skbprio enqueue/dequeue contains an assertion that fails under certain conditions when SKBPRIO is used as a child qdisc under TBF with specific parameters. The failure occurs because TBF sometimes peeks at packets in the child qdisc without actually dequeuing them when tokens are unavailable. This peek operation creates a discrepancy between the parent and child qdisc queue length counters. When TBF later receives a high-priority packet, SKBPRIO's queue length may show a different value than what's reflected in its internal priority queue tracking, triggering the assertion. The fix removes this overly strict assertions in SKBPRIO, they are not necessary at all.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2025-38637 is a Linux kernel traffic-control bug. In a specific setup where SKBPRIO is used under TBF, internal queue counters can disagree after TBF peeks at packets. That can trigger an unnecessary kernel assertion. Public sources do not provide CVSS, CWE, confirmed impact, or active exploitation.

Executive priority

Treat this as a targeted kernel maintenance item, not an emergency from the provided evidence. Prioritize systems that deliberately use Linux traffic shaping with TBF and SKBPRIO, then fold broader remediation into normal kernel patch cycles.

Technical view

The issue is in Linux net_sched skbprio enqueue/dequeue assertions. TBF may peek at the child qdisc without dequeuing when tokens are unavailable, creating a mismatch between qdisc queue length and skbprio internal priority tracking. Later high-priority traffic can trigger the assertion. The upstream fix removes the overly strict assertions.

Likely exposure

Exposure appears limited to Linux systems using the SKBPRIO qdisc as a child under TBF with specific traffic-control parameters. General Linux systems without that qdisc arrangement are less likely to be exposed based on the provided description.

Exploitation context

The source bundle shows KEV is false and provides no cited evidence of active exploitation. It describes a condition-dependent assertion failure, not a public exploit chain, remote attack path, or privilege requirement.

Researcher notes

Impact evidence is incomplete: no CVSS, CWE, exploit status, or explicit consequence is provided. Analysis should focus on affected stable branches, the skbprio/TBF interaction, and whether assertion failure has availability impact in the organization’s kernel build and runtime configuration.

Mitigation direction

  • Apply vendor kernel updates that include the referenced stable fixes.
  • Check Debian LTS advisories if running affected Debian kernels.
  • Review traffic-control configurations using TBF with SKBPRIO child qdiscs.
  • If patch timing is delayed, consult vendor guidance for supported workarounds.

Validation and detection

  • Inventory Linux kernel versions against vendor security advisories.
  • Identify hosts using SKBPRIO under TBF traffic-control configurations.
  • Confirm patched kernels contain one of the referenced stable commits.
  • Review kernel logs for related net_sched or qdisc assertion events.
Prepared
Confidence
medium
Sources
12

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-38637 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
1ADP providers
12Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxaea5f654e6b78a0c976f7a25950155932c77a53f, aea5f654e6b78a0c976f7a25950155932c77a53f, aea5f654e6b78a0c976f7a25950155932c77a53f, aea5f654e6b78a0c976f7a25950155932c77a53f, aea5f654e6b78a0c976f7a25950155932c77a53f, aea5f654e6b78a0c976f7a25950155932c77a53f, aea5f654e6b78a0c976f7a25950155932c77a53f, aea5f654e6b78a0c976f7a25950155932c77a53f, aea5f654e6b78a0c976f7a25950155932c77a53funaffected
LinuxLinux4.19, 0, 5.4.292, 5.10.236, 5.15.180, 6.1.134, 6.6.87, 6.12.23, 6.13.11, 6.14.2, 6.15affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.