CVE-2025-38350: Linux Kernel Use-After-Free Vulnerability

CVE-2025-38350 Overview

CVE-2025-38350 is a use-after-free vulnerability [CWE-416] in the Linux kernel's net/sched packet scheduler subsystem. The flaw resides in how classful queueing disciplines (qdiscs) handle backlog accounting when a child class becomes empty during an enqueue operation. Certain classful qdiscs invoke their classes' dequeue handler on enqueue, which can unexpectedly empty the child qdisc and mark an in-flight class passive via qlen_notify(). Most qdiscs do not anticipate this state transition and may re-activate the class, leading to operations on freed memory. A local user with CAP_NET_ADMIN capabilities, or one able to manipulate traffic control configurations, can trigger the condition to achieve local privilege escalation or kernel memory corruption.

Critical Impact
Local attackers can trigger a use-after-free in the kernel's traffic control subsystem, potentially leading to privilege escalation, kernel memory corruption, or denial of service on affected Linux systems.

Affected Products

Linux kernel versions prior to the fix commits, including 6.15 and 6.16-rc1 through 6.16-rc4
Debian Linux 11.0 (as referenced in Debian LTS advisories)
Siemens products bundling affected kernel versions (per advisories SSA-082556 and SSA-089022)

Discovery Timeline

2025-07-19 - CVE-2025-38350 published to NVD
2026-05-12 - Last updated in NVD database

Technical Details for CVE-2025-38350

Vulnerability Analysis

The vulnerability stems from improper state handling in the Linux kernel network scheduler. Classful qdiscs such as Hierarchical Fair Service Curve (HFSC) may call a class's dequeue handler during an enqueue operation. This can drain the child qdisc, causing the kernel to transition the class to a passive state via qlen_notify().

The original fix for a similar HFSC issue moved backlog accounting around to address the immediate case. That fix proved incomplete because the same condition can surface at the parent's parent. When a class is deleted, the kernel calls qdisc_reset() or qdisc_purge_queue(), but stale references on parent classes can persist. Subsequent enqueue or dequeue operations then dereference freed class pointers, producing a use-after-free.

The reproducer published with the fix chains a Deficit Round Robin (DRR) root qdisc, an HFSC child, a netem qdisc, and a blackhole qdisc on the loopback interface. Sending a UDP datagram, deleting the parent class, and sending another datagram triggers the freed-pointer access.

Root Cause

The root cause is incomplete backlog accounting in qdisc_tree_reduce_backlog(). Earlier kernel versions did not consistently invoke qlen_notify() on parent qdiscs when a child qdisc became empty mid-operation. This left parent classes holding references to children whose state had already changed, violating the invariants that classful schedulers rely on for safe memory management.

Attack Vector

Exploitation requires local access with the ability to configure traffic control rules, typically through the tc utility. An attacker constructs a nested qdisc hierarchy combining classful schedulers, sends crafted network traffic to trigger the enqueue/dequeue race, then deletes a class while operations are pending. The resulting dangling pointer dereference can be steered toward controlled kernel memory to achieve privilege escalation. The published reproducer demonstrates the issue using drr, hfsc, netem, and blackhole qdiscs combined with UDP traffic generated via socat.

No public exploit code beyond the proof-of-concept reproducer in the upstream commit message has been observed. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2025-38350

Indicators of Compromise

Kernel oops or panic messages referencing qdisc_tree_reduce_backlog, qlen_notify, hfsc_dequeue, or drr_dequeue in dmesg or /var/log/kern.log
Unexpected creation of nested qdisc hierarchies on loopback or other interfaces by non-administrative users
KASAN (Kernel Address Sanitizer) reports flagging use-after-free in the net/sched subsystem

Detection Strategies

Audit tc qdisc and tc class operations through kernel audit rules to identify unusual hierarchical qdisc constructions
Monitor for processes invoking tc with non-standard classful qdisc combinations such as DRR containing HFSC containing netem
Correlate kernel ring buffer warnings with subsequent privilege escalation attempts or anomalous process behavior

Monitoring Recommendations

Enable auditd rules covering the setsockopt and netlink operations used by traffic control changes
Forward kernel logs to a centralized SIEM and alert on stack traces referencing pkt_sched functions
Track process lineage for users invoking tc outside expected administrative workflows

How to Mitigate CVE-2025-38350

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the stable git commits listed below and reboot affected systems
Install distribution updates such as the Debian LTS kernel packages from the October 2025 advisories
Restrict CAP_NET_ADMIN to trusted administrative accounts and remove it from container workloads that do not require traffic shaping

Patch Information

The fix changes qdisc_tree_reduce_backlog() to always call qlen_notify() when the child qdisc is empty, rather than attempting to repair backlog accounting after the fact. This approach works because qdisc deletion always calls qdisc_reset() or qdisc_purge_queue(), which sets qlen to zero. The patch relies on prior work that made all classful qdisc qlen_notify() handlers idempotent. The fix is available in the following kernel commits: Kernel Commit 103406b, Kernel Commit 3b290923, Kernel Commit 7874c9c, Kernel Commit a44acdd, Kernel Commit a553afd, Kernel Commit e269f29, Kernel Commit e9921b5, and Kernel Commit f680a46. Vendor advisories include the Debian LTS Announcement (msg00007), Debian LTS Announcement (msg00008), Siemens Advisory SSA-082556, and Siemens Advisory SSA-089022.

Workarounds

Where patching is not immediately possible, prevent unprivileged users from creating qdiscs by ensuring CAP_NET_ADMIN is not granted to general user namespaces
Disable user namespaces for untrusted workloads via sysctl -w kernel.unprivileged_userns_clone=0 on distributions that expose this knob
Avoid loading the sch_hfsc, sch_drr, and sch_netem modules on systems that do not require advanced traffic control, and blacklist them through /etc/modprobe.d/

bash

# Configuration example: disable unprivileged user namespaces and blacklist unused qdisc modules
sudo sysctl -w kernel.unprivileged_userns_clone=0
echo 'kernel.unprivileged_userns_clone=0' | sudo tee /etc/sysctl.d/99-cve-2025-38350.conf

cat <<'EOF' | sudo tee /etc/modprobe.d/disable-qdiscs.conf
blacklist sch_hfsc
blacklist sch_drr
blacklist sch_netem
EOF

sudo update-initramfs -u