CVE-2025-38477 Overview
CVE-2025-38477 is a race condition in the Linux kernel's Quick Fair Queueing (QFQ) packet scheduler (net/sched/sch_qfq). The flaw affects the qfq_aggregate structure, which can be modified in qfq_change_agg during qfq_enqueue while other threads access it concurrently. Attackers with local access can trigger a NULL pointer dereference via qfq_dump_class or a use-after-free via qfq_delete_class. The vulnerability is classified as a concurrent execution using shared resource with improper synchronization ([CWE-362]). Debian has issued Long Term Support advisories, and Siemens has published a related product advisory.
Critical Impact
Local users with CAP_NET_ADMIN can crash the kernel or trigger memory corruption in the network scheduling subsystem, resulting in denial of service on affected Linux systems.
Affected Products
- Linux Kernel (multiple stable branches, including 6.16 release candidates rc1 through rc6)
- Debian Linux 11.0 (LTS)
- Siemens products referenced in advisory SSA-082556
Discovery Timeline
- 2025-07-28 - CVE-2025-38477 published to NVD
- 2026-07-30 - Last updated in NVD database
Technical Details for CVE-2025-38477
Vulnerability Analysis
The QFQ qdisc implements a hierarchical fair scheduling algorithm using aggregate structures (struct qfq_aggregate) that group classes with similar service weights. The race window opens when qfq_change_agg, invoked from the packet enqueue path, mutates the agg pointer for a class without synchronizing against concurrent readers.
Two concrete outcomes emerge from the unsynchronized access. First, qfq_dump_class may observe a partially updated aggregate and dereference a NULL pointer while serializing class attributes to netlink. Second, qfq_delete_class can operate on an aggregate that another thread has already released, producing a use-after-free on freed slab memory.
The upstream fix moves qfq_destroy_class into the critical section and wraps qfq_dump_class and qfq_dump_class_stats with sch_tree_lock. This serializes aggregate mutation against both class teardown and netlink dump paths.
Root Cause
The root cause is missing lock coverage around qfq_aggregate transitions. The enqueue-time aggregate rebinding in qfq_change_agg was not protected by sch_tree_lock, so dump and delete paths could see intermediate or stale state. Classification as [CWE-362] reflects that correctness depends on ordering guarantees the code did not enforce.
Attack Vector
Exploitation requires local access and the ability to configure traffic control on a network device, typically granted by CAP_NET_ADMIN inside a user namespace or on the host. An attacker races repeated tc class change operations that trigger qfq_change_agg against concurrent tc class show (qfq_dump_class) and tc class delete (qfq_delete_class) invocations on the same qdisc. Winning the race deterministically leads to a kernel NULL dereference or use-after-free, panicking the host or corrupting scheduler state.
No verified public exploit code is available. The vulnerability manifests only under contended qdisc configuration and is described in the referenced kernel commits.
Detection Methods for CVE-2025-38477
Indicators of Compromise
- Kernel oops or panic logs referencing qfq_dump_class, qfq_delete_class, or qfq_change_agg in the call stack.
- KASAN reports flagging use-after-free on struct qfq_aggregate allocations from sch_qfq.ko.
- Unexpected termination of processes issuing tc commands against QFQ qdiscs.
Detection Strategies
- Enable KASAN and lockdep on test kernels to surface racing accesses to qfq_aggregate during fuzzing of tc operations.
- Audit AUDIT_ANOM_ABEND and kernel.panic telemetry for crashes originating in net/sched/sch_qfq.c.
- Correlate tc invocations from non-privileged user namespaces with kernel warnings in dmesg.
Monitoring Recommendations
- Forward /var/log/kern.log and journald kernel messages to a central log store and alert on QFQ-related stack traces.
- Track processes that invoke tc qdisc and tc class syscalls on production hosts, particularly from containerized workloads with CAP_NET_ADMIN.
- Monitor unexpected reboots on kernels that predate the fix commits listed in the Linux stable tree.
How to Mitigate CVE-2025-38477
Immediate Actions Required
- Apply the vendor kernel update that includes the upstream fixes referenced in the stable commits, including 466e1019, 5e28d5a3, a6d73510, aa7a22c4, c000a3a3, c6df7940, d841aa55, and fbe48f06.
- On Debian systems, install kernel packages from Debian LTS Announcement #7 and Debian LTS Announcement #8.
- For Siemens deployments, follow guidance in Siemens Security Advisory SSA-082556.
Patch Information
The fix is distributed as a series of backports across Linux stable branches. Each commit adds sch_tree_lock protection around QFQ dump paths and relocates class destruction inside the critical section. Reference commits: 466e10194ab8, 5e28d5a3f774, a6d735100f60, aa7a22c4d678, c000a3a330d9, c6df79400014, d841aa551850, and fbe48f06e641.
Workarounds
- Restrict CAP_NET_ADMIN on multi-tenant hosts and disable unprivileged user namespaces where policy allows (sysctl -w kernel.unprivileged_userns_clone=0).
- Blocklist the sch_qfq module on systems that do not require Quick Fair Queueing scheduling.
- Replace QFQ qdiscs with alternative schedulers such as fq_codel or htb until the patched kernel is deployed.
# Prevent the vulnerable module from loading
echo "install sch_qfq /bin/true" | sudo tee /etc/modprobe.d/disable-sch_qfq.conf
sudo rmmod sch_qfq 2>/dev/null || true
# Verify the QFQ scheduler is not attached to any interface
tc qdisc show | grep -i qfq
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
