HIGH Public exploit Introduced in 4.14
net HFSC Qdisc Corruption
CVE-2025-38177
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI7.8HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: sch_hfsc: make hfsc_qlen_notify() idempotent hfsc_qlen_notify() is not idempotent either and not friendly to its callers, like fq_codel_dequeue(). Let's make it idempotent to ease qdisc_tree_reduce_backlog() callers' life: 1. update_vf() decreases cl->cl_nactive, so we can check whether it is non-zero before calling it. 2. eltree_remove() always removes RB node cl->el_node, but we can use RB_EMPTY_NODE() + RB_CLEAR_NODE() to make it safe.
02KernelScan AI Analysis
Risk summary
A local actor able to administer HFSC traffic-control queues can cause scheduler state to be cleaned up twice, corrupting kernel bookkeeping and crashing the kernel. In multi-tenant environments, tenant code with namespaced network-administration rights could disrupt all services sharing the host kernel.
Vulnerability analysis
The vulnerable scheduler assumes that a queue-length notification is delivered only once, but a second notification can perform final deactivation after active state is already gone and attempt to remove the same scheduling entry again, corrupting internal bookkeeping and crashing the kernel. The fix makes cleanup repeatable by skipping final deactivation when nothing remains active and by marking a scheduling entry as removed only when it is actually linked. The path is local and requires permission to configure or control HFSC traffic-control queues, which may be available to a tenant in its own network namespace; no special hardware or remote network access is required.
Exploit availability
KernelScan found public exploit code for this CVE. Open it in the CVE browser to see what we found, where, and how strong the evidence is — that needs a free account with a confirmed email address.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.10 | 4.14 | 5.10.241 | 72c61ffbeeb8 |
| 5.15 | 4.14 | 5.15.190 | a5efc95a33bd |
| 5.4 | 4.14 | 5.4.297 | 9a5fd5c2f4d4 |
| 6.1 | 4.14 | 6.1.138 | 0475c85426b1 |
| 6.12 | 4.14 | 6.12.28 | d06476714d28 |
| 6.14 | 4.14 | 6.14.6 | c1175c4ad01d |
| 6.6 | 4.14 | 6.6.90 | 9030a91235ae |
| mainline | 4.14 | 6.15 | 51eb3b65544c |
| cip/4.19 | 4.14 | 4.19.325-cip124 | d1904bb7bf33 |
| cip/4.19-rt | 4.14 | 4.19.325-cip124-rt44 | d1904bb7bf33 |
| cip/5.10 | 4.14 | 5.10.241-cip64 | 72c61ffbeeb8 |
| cip/5.10-rt | 4.14 | 5.10.241-cip64-rt28 | 72c61ffbeeb8 |
| cip/6.1 | 4.14 | 6.1.141-cip43 | 0475c85426b1 |
| cip/6.1-rt | 4.14 | 6.1.141-cip43-rt23 | 0475c85426b1 |
| cip/6.12 | 4.14 | 6.12.29-cip1 | d06476714d28 |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Fixed in 6.12.29-cip1 |
| cip/6.1 | Fixed in 6.1.141-cip43 |
| cip/6.1-rt | Fixed in 6.1.141-cip43-rt23 |
| cip/5.10 | Fixed in 5.10.241-cip64 |
| cip/5.10-rt | Fixed in 5.10.241-cip64-rt28 |
| cip/4.19 | Fixed in 4.19.325-cip124 |
| cip/4.19-rt | Fixed in 4.19.325-cip124-rt44 |