Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2025-38000
CVE-2025-38000:
Linux Kernel vulnerability analysis and mitigation
Overview
CVE-2025-38000 is a vulnerability discovered in the Linux kernel, specifically affecting the HFSC (Hierarchical Fair Service Curve) scheduler component. The vulnerability was disclosed on June 6, 2025, and involves a queue length accounting bug in the hfsc_enqueue() function (NVD).
Technical details
The vulnerability occurs in the HFSC scheduler's queue management system when enqueuing the first packet to an HFSC class. The issue arises because hfscenqueue() calls the child qdisc's peek() operation before incrementing sch->q.qlen and sch->qstats.backlog. When the child qdisc uses qdiscpeek_dequeued(), this sequence can trigger an immediate dequeue and potential packet drop, leading to inconsistent queue accounting (NVD).
Impact
The vulnerability can result in inconsistent queue accounting, which may leave an empty HFSC class in the active list. This condition can potentially lead to use-after-free scenarios, affecting the system's stability and security (NVD).
Mitigation and workarounds
The vulnerability has been resolved by moving the increment of sch->q.qlen and sch->qstats.backlog before the call to the child qdisc's peek() operation. This ensures that queue length and backlog are always accurate when packet drops or dequeues are triggered during the peek operation (NVD).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management