Security readout for executives and security teams
Plain-English summary
CVE-2025-38684 is a Linux kernel crash bug in the ETS traffic scheduler. Changing ETS queue settings can leave cleanup code using an inconsistent band count, causing a NULL pointer dereference and kernel oops. The evidence points to availability risk, not data theft or remote code execution.
Executive priority
Treat as a scheduled availability fix for Linux infrastructure, higher priority where untrusted tenants, automation, or operators can change traffic-control settings. Escalate for network appliances or shared hosts that expose qdisc management paths.
Technical view
The flaw is in net/sched sch_ets, specifically ets_qdisc_change() purging unused DWRR queues after q->nbands changed. Cleanup then calls class lookup logic expecting the old configuration. The reported failure crashes in ets_class_qlen_notify() through qdisc backlog reduction during tc/rtnetlink qdisc modification.
Likely exposure
Linux systems running affected kernels with the sch_ets scheduler available are relevant. Practical exposure appears tied to actors or services able to modify traffic-control qdiscs, typically requiring administrative network privileges. Kernel-derived products should rely on vendor advisories.
Exploitation context
The bundle provides a kernel crash trace triggered through tc qdisc modification. It does not cite CISA KEV listing, public exploitation, exploit code, or remote unauthenticated exploitation. KEV is false in the supplied data.
Researcher notes
Key evidence is the upstream fix rationale and oops trace. Root cause is ordering of ETS cleanup relative to q->nbands and q->nstrict state. The supplied sources do not provide CVSS, CWE, exploit status, or a product-specific complete version matrix.
Mitigation direction
- Update to a vendor kernel containing the referenced stable fixes.
- Track Debian LTS and device-vendor advisories for backported packages.
- Restrict qdisc administration to trusted operators until patched.
- Review appliances using Linux kernels for vendor-specific update guidance.
Validation and detection
- Inventory Linux kernel versions across servers, appliances, and images.
- Check whether sch_ets is present or used in traffic-control configurations.
- Confirm installed kernel includes the relevant stable fix or vendor backport.
- Review change paths granting CAP_NET_ADMIN or equivalent network control privileges.
Public sources used
- CVE Program
- CVE List V5
- Linux stable commit bdfddcde86e8
- Linux stable commit be9692dafdfb
- Linux stable commit 97ec167cd2e8
- Linux stable commit 84a24fb446ee
- Linux stable commit 5b3b346bc4c2
- Linux stable commit d69f4a258cd9
- Linux stable commit 970c1c731c4e
- Linux stable commit 87c6efc5ce9c
- Debian LTS announcement msg00008
- Debian LTS announcement msg00007
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-38684 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/bdfddcde86e8b9245d9c0c2efe2b6fe8dcf6bf41CVE reference, Linux
- https://git.kernel.org/stable/c/be9692dafdfb36d9c43afd9d4e1d9d9ba8e7b51bCVE reference, Linux
- https://git.kernel.org/stable/c/97ec167cd2e8a81a2d87331a2ed92daf007542c8CVE reference, Linux
- https://git.kernel.org/stable/c/84a24fb446ee07b22b64aae6f0e3f4a38266310aCVE reference, Linux
- https://git.kernel.org/stable/c/5b3b346bc4c2aa2c428735438a11989d251f32f1CVE reference, Linux
- https://git.kernel.org/stable/c/d69f4a258cd91b3bcef7089eb0401005aae2aed5CVE reference, Linux
- https://git.kernel.org/stable/c/970c1c731c4ede46d05f5b0355724d1e400cfbcaCVE reference, Linux
- https://git.kernel.org/stable/c/87c6efc5ce9c126ae4a781bc04504b83780e3650CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.htmlCVE reference, CVE
- https://lists.debian.org/debian-lts-announce/2025/10/msg00007.htmlCVE reference, CVE
- https://cert-portal.siemens.com/productcert/html/ssa-032379.htmlCVE reference, siemens-SADP
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.