CVE-2025-38278

CVE-2025-38278

High · published July 10, 2025

CVSS v3.1
7.8
EPSS
0%
Percentile
9.4
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

octeontx2-pf: QOS: Refactor TC_HTB_LEAF_DEL_LAST callback

This patch addresses below issues,

1. Active traffic on the leaf node must be stopped before its send queue

is reassigned to the parent. This patch resolves the issue by marking

the node as 'Inner'.

2. During a system reboot, the interface receives TC_HTB_LEAF_DEL

and TC_HTB_LEAF_DEL_LAST callbacks to delete its HTB queues.

In the case of TC_HTB_LEAF_DEL_LAST, although the same send queue

is reassigned to the parent, the current logic still attempts to update

the real number of queues, leadning to below warnings

New queues can't be registered after device unregistration.

WARNING: CPU: 0 PID: 6475 at net/core/net-sysfs.c:1714

netdev_queue_update_kobjects+0x1e4/0x200

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00200 · 9.4th percentile
Published
2025-07-10T12:15Z
Affected products (3)
ProductVersionsFixed in
linux/linux_kernel≥ 6.5, < 6.6.946.6.94
linux/linux_kernel≥ 6.7, < 6.12.346.12.34
linux/linux_kernel≥ 6.13, < 6.15.36.15.3
References (4)
EPSS history
Timeline
  • 10 JUL 07:41Z
    octeontx2-pf: QOS: Refactor TC_HTB_LEAF_DEL_LAST callback
    cvelistv5