In the Linux kernel, the following vulnerability has been resolved:
net/sched: Abort _tcmodify_qdisc if parent class does not exist
Lion's patch [1] revealed an ancient bug in the qdisc API. Whenever a user creates/modifies a qdisc specifying as a parent another qdisc, the qdisc API will, during grafting, detect that the user is not trying to attach to a class and reject. However grafting is performed after qdisccreate (and thus the qdiscs' init callback) is executed. In qdiscs that eventually call qdisctreereducebacklog during init or change (such as fq, hhf, choke, etc), an issue arises. For example, executing the following commands:
sudo tc qdisc add dev lo root handle a: htb default 2 sudo tc qdisc add dev lo parent a: handle beef fq
Qdiscs such as fq, hhf, choke, etc unconditionally invoke qdisctreereducebacklog() in their control path init() or change() which then causes a failure to find the child class; however, that does not stop the unconditional invocation of the assumed child qdisc's qlennotify with a null class. All these qdiscs make the assumption that class is non-null.
The solution is ensure that qdiscleaf() which looks up the parent class, and is invoked prior to qdisccreate(), should return failure on not finding the class. In this patch, we leverage qdiscleaf to return ERRPTRs whenever the parentid doesn't correspond to a class, so that we can detect it earlier on and abort before qdisc_create is called.
[1] https://lore.kernel.org/netdev/d912cbd7-193b-4269-9857-525bee8bbb6a@gmail.com/
[
{
"id": "CVE-2025-38457-0b6180c4",
"digest": {
"length": 1686.0,
"function_hash": "24652832624271383479458098067571788759"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ffdde7bf5a439aaa1955ebd581f5c64ab1533963",
"target": {
"file": "net/sched/sch_api.c",
"function": "__tc_get_qdisc"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2025-38457-1aef4f03",
"digest": {
"length": 263.0,
"function_hash": "148148427920508959293871969998029030018"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@25452638f133ac19d75af3f928327d8016952c8e",
"target": {
"file": "net/sched/sch_api.c",
"function": "qdisc_leaf"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2025-38457-220cb99d",
"digest": {
"length": 263.0,
"function_hash": "148148427920508959293871969998029030018"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@923a276c74e25073ae391e930792ac86a9f77f1e",
"target": {
"file": "net/sched/sch_api.c",
"function": "qdisc_leaf"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2025-38457-2da655d8",
"digest": {
"length": 4084.0,
"function_hash": "170227537955171304229781064675542564065"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@90436e72c9622c2f70389070088325a3232d339f",
"target": {
"file": "net/sched/sch_api.c",
"function": "tc_modify_qdisc"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2025-38457-2e0068cb",
"digest": {
"length": 4015.0,
"function_hash": "165284557233120878183753343611965047692"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4c691d1b6b6dbd73f30ed9ee7da05f037b0c49af",
"target": {
"file": "net/sched/sch_api.c",
"function": "tc_modify_qdisc"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2025-38457-2e15f7d2",
"digest": {
"length": 1950.0,
"function_hash": "29425544628122337292954295246862168826"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@25452638f133ac19d75af3f928327d8016952c8e",
"target": {
"file": "net/sched/sch_api.c",
"function": "tc_get_qdisc"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2025-38457-451346e9",
"digest": {
"length": 4084.0,
"function_hash": "170227537955171304229781064675542564065"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@25452638f133ac19d75af3f928327d8016952c8e",
"target": {
"file": "net/sched/sch_api.c",
"function": "tc_modify_qdisc"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2025-38457-56d6c6ea",
"digest": {
"line_hashes": [
"46727140150076037294093526902944022880",
"72336244755476187663826291153667731269",
"299141919384005926427399358833213993295",
"118776392414573629345164952913680867486",
"98835903149219697490044603831535229938",
"208825637152407454522053040427420876452",
"94585887081062188032219109269359546705",
"231414125601930797371831780640142818292",
"66231684834297714938921023920007972993",
"214632208566212257776431104722182789480",
"93015669344118164273179716615719015000",
"236316617760000801852308844929886680650",
"10712094362793388534784933019318350265",
"330597770370297359927904181059150499931",
"145971860093404024836245976983003127717",
"206481385176427213357790724391519990478",
"58667648633416663339705129845064382800",
"335677512488298545222561495471574273849",
"145521786493669456690647769071143287997",
"320600845133897919914617325201477853963",
"204885525893402123809387714592215008218",
"293641969392586751308566525460513023518",
"147541223955321950472288156075442408567",
"328342930917367259807177945993643947036"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e28a383d6485c3bb51dc5953552f76c4dea33eea",
"target": {
"file": "net/sched/sch_api.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2025-38457-59445e7d",
"digest": {
"length": 1686.0,
"function_hash": "24652832624271383479458098067571788759"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e28a383d6485c3bb51dc5953552f76c4dea33eea",
"target": {
"file": "net/sched/sch_api.c",
"function": "__tc_get_qdisc"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2025-38457-63ff5c37",
"digest": {
"length": 4084.0,
"function_hash": "170227537955171304229781064675542564065"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@923a276c74e25073ae391e930792ac86a9f77f1e",
"target": {
"file": "net/sched/sch_api.c",
"function": "tc_modify_qdisc"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2025-38457-653dab01",
"digest": {
"line_hashes": [
"46727140150076037294093526902944022880",
"72336244755476187663826291153667731269",
"299141919384005926427399358833213993295",
"118776392414573629345164952913680867486",
"98835903149219697490044603831535229938",
"208825637152407454522053040427420876452",
"94585887081062188032219109269359546705",
"231414125601930797371831780640142818292",
"66231684834297714938921023920007972993",
"214632208566212257776431104722182789480",
"93015669344118164273179716615719015000",
"236316617760000801852308844929886680650",
"10712094362793388534784933019318350265",
"330597770370297359927904181059150499931",
"291940435082713226258205127984637918790",
"333895096999008934700190730253894492267",
"58667648633416663339705129845064382800",
"335677512488298545222561495471574273849",
"145521786493669456690647769071143287997",
"320600845133897919914617325201477853963",
"204885525893402123809387714592215008218",
"293641969392586751308566525460513023518",
"144609554608794026638690051192540728946",
"157226187243481500346022979989536953762"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@90436e72c9622c2f70389070088325a3232d339f",
"target": {
"file": "net/sched/sch_api.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2025-38457-6a897368",
"digest": {
"line_hashes": [
"46727140150076037294093526902944022880",
"72336244755476187663826291153667731269",
"299141919384005926427399358833213993295",
"118776392414573629345164952913680867486",
"98835903149219697490044603831535229938",
"208825637152407454522053040427420876452",
"94585887081062188032219109269359546705",
"231414125601930797371831780640142818292",
"66231684834297714938921023920007972993",
"214632208566212257776431104722182789480",
"93015669344118164273179716615719015000",
"236316617760000801852308844929886680650",
"10712094362793388534784933019318350265",
"330597770370297359927904181059150499931",
"145971860093404024836245976983003127717",
"206481385176427213357790724391519990478",
"58667648633416663339705129845064382800",
"335677512488298545222561495471574273849",
"145521786493669456690647769071143287997",
"320600845133897919914617325201477853963",
"204885525893402123809387714592215008218",
"293641969392586751308566525460513023518",
"147541223955321950472288156075442408567",
"328342930917367259807177945993643947036"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ffdde7bf5a439aaa1955ebd581f5c64ab1533963",
"target": {
"file": "net/sched/sch_api.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2025-38457-6fef24fb",
"digest": {
"length": 263.0,
"function_hash": "148148427920508959293871969998029030018"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@90436e72c9622c2f70389070088325a3232d339f",
"target": {
"file": "net/sched/sch_api.c",
"function": "qdisc_leaf"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2025-38457-73ef0a1a",
"digest": {
"length": 263.0,
"function_hash": "148148427920508959293871969998029030018"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4c691d1b6b6dbd73f30ed9ee7da05f037b0c49af",
"target": {
"file": "net/sched/sch_api.c",
"function": "qdisc_leaf"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2025-38457-85ff6dc7",
"digest": {
"line_hashes": [
"46727140150076037294093526902944022880",
"72336244755476187663826291153667731269",
"299141919384005926427399358833213993295",
"118776392414573629345164952913680867486",
"98835903149219697490044603831535229938",
"208825637152407454522053040427420876452",
"94585887081062188032219109269359546705",
"231414125601930797371831780640142818292",
"66231684834297714938921023920007972993",
"214632208566212257776431104722182789480",
"93015669344118164273179716615719015000",
"236316617760000801852308844929886680650",
"10712094362793388534784933019318350265",
"330597770370297359927904181059150499931",
"291940435082713226258205127984637918790",
"333895096999008934700190730253894492267",
"58667648633416663339705129845064382800",
"335677512488298545222561495471574273849",
"145521786493669456690647769071143287997",
"320600845133897919914617325201477853963",
"204885525893402123809387714592215008218",
"293641969392586751308566525460513023518",
"144609554608794026638690051192540728946",
"157226187243481500346022979989536953762"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@25452638f133ac19d75af3f928327d8016952c8e",
"target": {
"file": "net/sched/sch_api.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2025-38457-896365a7",
"digest": {
"length": 1849.0,
"function_hash": "286156757468769819205032031585146834353"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4c691d1b6b6dbd73f30ed9ee7da05f037b0c49af",
"target": {
"file": "net/sched/sch_api.c",
"function": "tc_get_qdisc"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2025-38457-a10d21d2",
"digest": {
"line_hashes": [
"46727140150076037294093526902944022880",
"72336244755476187663826291153667731269",
"299141919384005926427399358833213993295",
"118776392414573629345164952913680867486",
"98835903149219697490044603831535229938",
"208825637152407454522053040427420876452",
"94585887081062188032219109269359546705",
"231414125601930797371831780640142818292",
"66231684834297714938921023920007972993",
"214632208566212257776431104722182789480",
"93015669344118164273179716615719015000",
"236316617760000801852308844929886680650",
"10712094362793388534784933019318350265",
"330597770370297359927904181059150499931",
"291940435082713226258205127984637918790",
"333895096999008934700190730253894492267",
"58667648633416663339705129845064382800",
"335677512488298545222561495471574273849",
"145521786493669456690647769071143287997",
"320600845133897919914617325201477853963",
"204885525893402123809387714592215008218",
"293641969392586751308566525460513023518",
"144609554608794026638690051192540728946",
"157226187243481500346022979989536953762"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@923a276c74e25073ae391e930792ac86a9f77f1e",
"target": {
"file": "net/sched/sch_api.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2025-38457-a5347a1d",
"digest": {
"length": 1950.0,
"function_hash": "29425544628122337292954295246862168826"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@923a276c74e25073ae391e930792ac86a9f77f1e",
"target": {
"file": "net/sched/sch_api.c",
"function": "tc_get_qdisc"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2025-38457-a56fc52b",
"digest": {
"line_hashes": [
"46727140150076037294093526902944022880",
"72336244755476187663826291153667731269",
"299141919384005926427399358833213993295",
"118776392414573629345164952913680867486",
"98835903149219697490044603831535229938",
"208825637152407454522053040427420876452",
"94585887081062188032219109269359546705",
"231414125601930797371831780640142818292",
"66231684834297714938921023920007972993",
"214632208566212257776431104722182789480",
"93015669344118164273179716615719015000",
"236316617760000801852308844929886680650",
"10712094362793388534784933019318350265",
"330597770370297359927904181059150499931",
"145971860093404024836245976983003127717",
"206481385176427213357790724391519990478",
"58667648633416663339705129845064382800",
"335677512488298545222561495471574273849",
"145521786493669456690647769071143287997",
"320600845133897919914617325201477853963",
"204885525893402123809387714592215008218",
"293641969392586751308566525460513023518",
"147541223955321950472288156075442408567",
"328342930917367259807177945993643947036"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4c691d1b6b6dbd73f30ed9ee7da05f037b0c49af",
"target": {
"file": "net/sched/sch_api.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2025-38457-b6964156",
"digest": {
"length": 263.0,
"function_hash": "148148427920508959293871969998029030018"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ffdde7bf5a439aaa1955ebd581f5c64ab1533963",
"target": {
"file": "net/sched/sch_api.c",
"function": "qdisc_leaf"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2025-38457-cb9b8589",
"digest": {
"length": 263.0,
"function_hash": "148148427920508959293871969998029030018"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e28a383d6485c3bb51dc5953552f76c4dea33eea",
"target": {
"file": "net/sched/sch_api.c",
"function": "qdisc_leaf"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2025-38457-dcbc9a50",
"digest": {
"length": 1950.0,
"function_hash": "29425544628122337292954295246862168826"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@90436e72c9622c2f70389070088325a3232d339f",
"target": {
"file": "net/sched/sch_api.c",
"function": "tc_get_qdisc"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2025-38457-f261c00a",
"digest": {
"length": 3851.0,
"function_hash": "11416567009358150385090763909173654052"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e28a383d6485c3bb51dc5953552f76c4dea33eea",
"target": {
"file": "net/sched/sch_api.c",
"function": "__tc_modify_qdisc"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2025-38457-f39e8d82",
"digest": {
"length": 3851.0,
"function_hash": "11416567009358150385090763909173654052"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ffdde7bf5a439aaa1955ebd581f5c64ab1533963",
"target": {
"file": "net/sched/sch_api.c",
"function": "__tc_modify_qdisc"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
}
]