In the Linux kernel, the following vulnerability has been resolved:
net/sched: Abort _tcmodify_qdisc if parent class does not exist
Lion's patch [1] revealed an ancient bug in the qdisc API. Whenever a user creates/modifies a qdisc specifying as a parent another qdisc, the qdisc API will, during grafting, detect that the user is not trying to attach to a class and reject. However grafting is performed after qdisccreate (and thus the qdiscs' init callback) is executed. In qdiscs that eventually call qdisctreereducebacklog during init or change (such as fq, hhf, choke, etc), an issue arises. For example, executing the following commands:
sudo tc qdisc add dev lo root handle a: htb default 2 sudo tc qdisc add dev lo parent a: handle beef fq
Qdiscs such as fq, hhf, choke, etc unconditionally invoke qdisctreereducebacklog() in their control path init() or change() which then causes a failure to find the child class; however, that does not stop the unconditional invocation of the assumed child qdisc's qlennotify with a null class. All these qdiscs make the assumption that class is non-null.
The solution is ensure that qdiscleaf() which looks up the parent class, and is invoked prior to qdisccreate(), should return failure on not finding the class. In this patch, we leverage qdiscleaf to return ERRPTRs whenever the parentid doesn't correspond to a class, so that we can detect it earlier on and abort before qdisc_create is called.
[1] https://lore.kernel.org/netdev/d912cbd7-193b-4269-9857-525bee8bbb6a@gmail.com/
[ { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ffdde7bf5a439aaa1955ebd581f5c64ab1533963", "signature_version": "v1", "target": { "function": "__tc_get_qdisc", "file": "net/sched/sch_api.c" }, "digest": { "function_hash": "24652832624271383479458098067571788759", "length": 1686.0 }, "id": "CVE-2025-38457-0b6180c4" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@25452638f133ac19d75af3f928327d8016952c8e", "signature_version": "v1", "target": { "function": "qdisc_leaf", "file": "net/sched/sch_api.c" }, "digest": { "function_hash": "148148427920508959293871969998029030018", "length": 263.0 }, "id": "CVE-2025-38457-1aef4f03" }, { "signature_type": "Line", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8ecd651ef24ab50123692a4e3e25db93cb11602a", "signature_version": "v1", "target": { "file": "net/sched/sch_api.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "46727140150076037294093526902944022880", "72336244755476187663826291153667731269", "299141919384005926427399358833213993295", "118776392414573629345164952913680867486", "98835903149219697490044603831535229938", "208825637152407454522053040427420876452", "94585887081062188032219109269359546705", "231414125601930797371831780640142818292", "66231684834297714938921023920007972993", "214632208566212257776431104722182789480", "93015669344118164273179716615719015000", "236316617760000801852308844929886680650", "10712094362793388534784933019318350265", "330597770370297359927904181059150499931", "145971860093404024836245976983003127717", "206481385176427213357790724391519990478", "58667648633416663339705129845064382800", "335677512488298545222561495471574273849", "145521786493669456690647769071143287997", "320600845133897919914617325201477853963", "204885525893402123809387714592215008218", "293641969392586751308566525460513023518", "147541223955321950472288156075442408567", "328342930917367259807177945993643947036" ] }, "id": "CVE-2025-38457-1c22875b" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@923a276c74e25073ae391e930792ac86a9f77f1e", "signature_version": "v1", "target": { "function": "qdisc_leaf", "file": "net/sched/sch_api.c" }, "digest": { "function_hash": "148148427920508959293871969998029030018", "length": 263.0 }, "id": "CVE-2025-38457-220cb99d" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@90436e72c9622c2f70389070088325a3232d339f", "signature_version": "v1", "target": { "function": "tc_modify_qdisc", "file": "net/sched/sch_api.c" }, "digest": { "function_hash": "170227537955171304229781064675542564065", "length": 4084.0 }, "id": "CVE-2025-38457-2da655d8" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4c691d1b6b6dbd73f30ed9ee7da05f037b0c49af", "signature_version": "v1", "target": { "function": "tc_modify_qdisc", "file": "net/sched/sch_api.c" }, "digest": { "function_hash": "165284557233120878183753343611965047692", "length": 4015.0 }, "id": "CVE-2025-38457-2e0068cb" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@25452638f133ac19d75af3f928327d8016952c8e", "signature_version": "v1", "target": { "function": "tc_get_qdisc", "file": "net/sched/sch_api.c" }, "digest": { "function_hash": "29425544628122337292954295246862168826", "length": 1950.0 }, "id": "CVE-2025-38457-2e15f7d2" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@23c165dde88eac405eebb59051ea1fe139a45803", "signature_version": "v1", "target": { "function": "tc_get_qdisc", "file": "net/sched/sch_api.c" }, "digest": { "function_hash": "286156757468769819205032031585146834353", "length": 1849.0 }, "id": "CVE-2025-38457-36e74e47" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@25452638f133ac19d75af3f928327d8016952c8e", "signature_version": "v1", "target": { "function": "tc_modify_qdisc", "file": "net/sched/sch_api.c" }, "digest": { "function_hash": "170227537955171304229781064675542564065", "length": 4084.0 }, "id": "CVE-2025-38457-451346e9" }, { "signature_type": "Line", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e28a383d6485c3bb51dc5953552f76c4dea33eea", "signature_version": "v1", "target": { "file": "net/sched/sch_api.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "46727140150076037294093526902944022880", "72336244755476187663826291153667731269", "299141919384005926427399358833213993295", "118776392414573629345164952913680867486", "98835903149219697490044603831535229938", "208825637152407454522053040427420876452", "94585887081062188032219109269359546705", "231414125601930797371831780640142818292", "66231684834297714938921023920007972993", "214632208566212257776431104722182789480", "93015669344118164273179716615719015000", "236316617760000801852308844929886680650", "10712094362793388534784933019318350265", "330597770370297359927904181059150499931", "145971860093404024836245976983003127717", "206481385176427213357790724391519990478", "58667648633416663339705129845064382800", "335677512488298545222561495471574273849", "145521786493669456690647769071143287997", "320600845133897919914617325201477853963", "204885525893402123809387714592215008218", "293641969392586751308566525460513023518", "147541223955321950472288156075442408567", "328342930917367259807177945993643947036" ] }, "id": "CVE-2025-38457-56d6c6ea" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e28a383d6485c3bb51dc5953552f76c4dea33eea", "signature_version": "v1", "target": { "function": "__tc_get_qdisc", "file": "net/sched/sch_api.c" }, "digest": { "function_hash": "24652832624271383479458098067571788759", "length": 1686.0 }, "id": "CVE-2025-38457-59445e7d" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@923a276c74e25073ae391e930792ac86a9f77f1e", "signature_version": "v1", "target": { "function": "tc_modify_qdisc", "file": "net/sched/sch_api.c" }, "digest": { "function_hash": "170227537955171304229781064675542564065", "length": 4084.0 }, "id": "CVE-2025-38457-63ff5c37" }, { "signature_type": "Line", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@90436e72c9622c2f70389070088325a3232d339f", "signature_version": "v1", "target": { "file": "net/sched/sch_api.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "46727140150076037294093526902944022880", "72336244755476187663826291153667731269", "299141919384005926427399358833213993295", "118776392414573629345164952913680867486", "98835903149219697490044603831535229938", "208825637152407454522053040427420876452", "94585887081062188032219109269359546705", "231414125601930797371831780640142818292", "66231684834297714938921023920007972993", "214632208566212257776431104722182789480", "93015669344118164273179716615719015000", "236316617760000801852308844929886680650", "10712094362793388534784933019318350265", "330597770370297359927904181059150499931", "291940435082713226258205127984637918790", "333895096999008934700190730253894492267", "58667648633416663339705129845064382800", "335677512488298545222561495471574273849", "145521786493669456690647769071143287997", "320600845133897919914617325201477853963", "204885525893402123809387714592215008218", "293641969392586751308566525460513023518", "144609554608794026638690051192540728946", "157226187243481500346022979989536953762" ] }, "id": "CVE-2025-38457-653dab01" }, { "signature_type": "Line", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ffdde7bf5a439aaa1955ebd581f5c64ab1533963", "signature_version": "v1", "target": { "file": "net/sched/sch_api.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "46727140150076037294093526902944022880", "72336244755476187663826291153667731269", "299141919384005926427399358833213993295", "118776392414573629345164952913680867486", "98835903149219697490044603831535229938", "208825637152407454522053040427420876452", "94585887081062188032219109269359546705", "231414125601930797371831780640142818292", "66231684834297714938921023920007972993", "214632208566212257776431104722182789480", "93015669344118164273179716615719015000", "236316617760000801852308844929886680650", "10712094362793388534784933019318350265", "330597770370297359927904181059150499931", "145971860093404024836245976983003127717", "206481385176427213357790724391519990478", "58667648633416663339705129845064382800", "335677512488298545222561495471574273849", "145521786493669456690647769071143287997", "320600845133897919914617325201477853963", "204885525893402123809387714592215008218", "293641969392586751308566525460513023518", "147541223955321950472288156075442408567", "328342930917367259807177945993643947036" ] }, "id": "CVE-2025-38457-6a897368" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@90436e72c9622c2f70389070088325a3232d339f", "signature_version": "v1", "target": { "function": "qdisc_leaf", "file": "net/sched/sch_api.c" }, "digest": { "function_hash": "148148427920508959293871969998029030018", "length": 263.0 }, "id": "CVE-2025-38457-6fef24fb" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4c691d1b6b6dbd73f30ed9ee7da05f037b0c49af", "signature_version": "v1", "target": { "function": "qdisc_leaf", "file": "net/sched/sch_api.c" }, "digest": { "function_hash": "148148427920508959293871969998029030018", "length": 263.0 }, "id": "CVE-2025-38457-73ef0a1a" }, { "signature_type": "Line", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@25452638f133ac19d75af3f928327d8016952c8e", "signature_version": "v1", "target": { "file": "net/sched/sch_api.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "46727140150076037294093526902944022880", "72336244755476187663826291153667731269", "299141919384005926427399358833213993295", "118776392414573629345164952913680867486", "98835903149219697490044603831535229938", "208825637152407454522053040427420876452", "94585887081062188032219109269359546705", "231414125601930797371831780640142818292", "66231684834297714938921023920007972993", "214632208566212257776431104722182789480", "93015669344118164273179716615719015000", "236316617760000801852308844929886680650", "10712094362793388534784933019318350265", "330597770370297359927904181059150499931", "291940435082713226258205127984637918790", "333895096999008934700190730253894492267", "58667648633416663339705129845064382800", "335677512488298545222561495471574273849", "145521786493669456690647769071143287997", "320600845133897919914617325201477853963", "204885525893402123809387714592215008218", "293641969392586751308566525460513023518", "144609554608794026638690051192540728946", "157226187243481500346022979989536953762" ] }, "id": "CVE-2025-38457-85ff6dc7" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4c691d1b6b6dbd73f30ed9ee7da05f037b0c49af", "signature_version": "v1", "target": { "function": "tc_get_qdisc", "file": "net/sched/sch_api.c" }, "digest": { "function_hash": "286156757468769819205032031585146834353", "length": 1849.0 }, "id": "CVE-2025-38457-896365a7" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8ecd651ef24ab50123692a4e3e25db93cb11602a", "signature_version": "v1", "target": { "function": "tc_modify_qdisc", "file": "net/sched/sch_api.c" }, "digest": { "function_hash": "165284557233120878183753343611965047692", "length": 4015.0 }, "id": "CVE-2025-38457-9b76f962" }, { "signature_type": "Line", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@923a276c74e25073ae391e930792ac86a9f77f1e", "signature_version": "v1", "target": { "file": "net/sched/sch_api.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "46727140150076037294093526902944022880", "72336244755476187663826291153667731269", "299141919384005926427399358833213993295", "118776392414573629345164952913680867486", "98835903149219697490044603831535229938", "208825637152407454522053040427420876452", "94585887081062188032219109269359546705", "231414125601930797371831780640142818292", "66231684834297714938921023920007972993", "214632208566212257776431104722182789480", "93015669344118164273179716615719015000", "236316617760000801852308844929886680650", "10712094362793388534784933019318350265", "330597770370297359927904181059150499931", "291940435082713226258205127984637918790", "333895096999008934700190730253894492267", "58667648633416663339705129845064382800", "335677512488298545222561495471574273849", "145521786493669456690647769071143287997", "320600845133897919914617325201477853963", "204885525893402123809387714592215008218", "293641969392586751308566525460513023518", "144609554608794026638690051192540728946", "157226187243481500346022979989536953762" ] }, "id": "CVE-2025-38457-a10d21d2" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@923a276c74e25073ae391e930792ac86a9f77f1e", "signature_version": "v1", "target": { "function": "tc_get_qdisc", "file": "net/sched/sch_api.c" }, "digest": { "function_hash": "29425544628122337292954295246862168826", "length": 1950.0 }, "id": "CVE-2025-38457-a5347a1d" }, { "signature_type": "Line", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4c691d1b6b6dbd73f30ed9ee7da05f037b0c49af", "signature_version": "v1", "target": { "file": "net/sched/sch_api.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "46727140150076037294093526902944022880", "72336244755476187663826291153667731269", "299141919384005926427399358833213993295", "118776392414573629345164952913680867486", "98835903149219697490044603831535229938", "208825637152407454522053040427420876452", "94585887081062188032219109269359546705", "231414125601930797371831780640142818292", "66231684834297714938921023920007972993", "214632208566212257776431104722182789480", "93015669344118164273179716615719015000", "236316617760000801852308844929886680650", "10712094362793388534784933019318350265", "330597770370297359927904181059150499931", "145971860093404024836245976983003127717", "206481385176427213357790724391519990478", "58667648633416663339705129845064382800", "335677512488298545222561495471574273849", "145521786493669456690647769071143287997", "320600845133897919914617325201477853963", "204885525893402123809387714592215008218", "293641969392586751308566525460513023518", "147541223955321950472288156075442408567", "328342930917367259807177945993643947036" ] }, "id": "CVE-2025-38457-a56fc52b" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ffdde7bf5a439aaa1955ebd581f5c64ab1533963", "signature_version": "v1", "target": { "function": "qdisc_leaf", "file": "net/sched/sch_api.c" }, "digest": { "function_hash": "148148427920508959293871969998029030018", "length": 263.0 }, "id": "CVE-2025-38457-b6964156" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8ecd651ef24ab50123692a4e3e25db93cb11602a", "signature_version": "v1", "target": { "function": "qdisc_leaf", "file": "net/sched/sch_api.c" }, "digest": { "function_hash": "148148427920508959293871969998029030018", "length": 263.0 }, "id": "CVE-2025-38457-bbe27356" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e28a383d6485c3bb51dc5953552f76c4dea33eea", "signature_version": "v1", "target": { "function": "qdisc_leaf", "file": "net/sched/sch_api.c" }, "digest": { "function_hash": "148148427920508959293871969998029030018", "length": 263.0 }, "id": "CVE-2025-38457-cb9b8589" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8ecd651ef24ab50123692a4e3e25db93cb11602a", "signature_version": "v1", "target": { "function": "tc_get_qdisc", "file": "net/sched/sch_api.c" }, "digest": { "function_hash": "41457316650919068866295551282637520248", "length": 1842.0 }, "id": "CVE-2025-38457-d122d806" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@23c165dde88eac405eebb59051ea1fe139a45803", "signature_version": "v1", "target": { "function": "tc_modify_qdisc", "file": "net/sched/sch_api.c" }, "digest": { "function_hash": "165284557233120878183753343611965047692", "length": 4015.0 }, "id": "CVE-2025-38457-d2dea333" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@90436e72c9622c2f70389070088325a3232d339f", "signature_version": "v1", "target": { "function": "tc_get_qdisc", "file": "net/sched/sch_api.c" }, "digest": { "function_hash": "29425544628122337292954295246862168826", "length": 1950.0 }, "id": "CVE-2025-38457-dcbc9a50" }, { "signature_type": "Line", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@23c165dde88eac405eebb59051ea1fe139a45803", "signature_version": "v1", "target": { "file": "net/sched/sch_api.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "46727140150076037294093526902944022880", "72336244755476187663826291153667731269", "299141919384005926427399358833213993295", "118776392414573629345164952913680867486", "98835903149219697490044603831535229938", "208825637152407454522053040427420876452", "94585887081062188032219109269359546705", "231414125601930797371831780640142818292", "66231684834297714938921023920007972993", "214632208566212257776431104722182789480", "93015669344118164273179716615719015000", "236316617760000801852308844929886680650", "10712094362793388534784933019318350265", "330597770370297359927904181059150499931", "145971860093404024836245976983003127717", "206481385176427213357790724391519990478", "58667648633416663339705129845064382800", "335677512488298545222561495471574273849", "145521786493669456690647769071143287997", "320600845133897919914617325201477853963", "204885525893402123809387714592215008218", "293641969392586751308566525460513023518", "147541223955321950472288156075442408567", "328342930917367259807177945993643947036" ] }, "id": "CVE-2025-38457-e57cdf9c" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@23c165dde88eac405eebb59051ea1fe139a45803", "signature_version": "v1", "target": { "function": "qdisc_leaf", "file": "net/sched/sch_api.c" }, "digest": { "function_hash": "148148427920508959293871969998029030018", "length": 263.0 }, "id": "CVE-2025-38457-ed29e03a" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e28a383d6485c3bb51dc5953552f76c4dea33eea", "signature_version": "v1", "target": { "function": "__tc_modify_qdisc", "file": "net/sched/sch_api.c" }, "digest": { "function_hash": "11416567009358150385090763909173654052", "length": 3851.0 }, "id": "CVE-2025-38457-f261c00a" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ffdde7bf5a439aaa1955ebd581f5c64ab1533963", "signature_version": "v1", "target": { "function": "__tc_modify_qdisc", "file": "net/sched/sch_api.c" }, "digest": { "function_hash": "11416567009358150385090763909173654052", "length": 3851.0 }, "id": "CVE-2025-38457-f39e8d82" } ]