CVE-2025-38177

sch_hfsc: make hfsc_qlen_notify() idempotent

State: Published
Severity: 7.8 High
Published: Jul 4, 2025
Updated: Aug 5, 2026
Reserved: Apr 16, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

sch_hfsc: make hfsc_qlen_notify() idempotent

hfsc_qlen_notify() is not idempotent either and not friendly to its callers, like fq_codel_dequeue(). Let's make it idempotent to ease qdisc_tree_reduce_backlog() callers' life:

1. update_vf() decreases cl->cl_nactive, so we can check whether it is non-zero before calling it.

2. eltree_remove() always removes RB node cl->el_node, but we can use RB_EMPTY_NODE() + RB_CLEAR_NODE() to make it safe.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	959466588aa7f84ccf79ae36a1d89542eaf9aaec to before 9a5fd5c2f4d4afdd5e405083ee53e0789ce76956Affected 959466588aa7f84ccf79ae36a1d89542eaf9aaec to before 72c61ffbeeb8c50f6d4d70c65d3283aa1bac57a7Affected 959466588aa7f84ccf79ae36a1d89542eaf9aaec to before a5efc95a33bd4fcb879250852828cc58c7862970Affected 959466588aa7f84ccf79ae36a1d89542eaf9aaec to before 0475c85426b18eccdcb7f9fb58d8f8e9c6c58c87Affected 959466588aa7f84ccf79ae36a1d89542eaf9aaec to before 9030a91235ae4845ec71902c3e0cecfc9ed1f2dfAffected 959466588aa7f84ccf79ae36a1d89542eaf9aaec to before d06476714d2819b550e0cc39222347e2c8941c9dAffected 959466588aa7f84ccf79ae36a1d89542eaf9aaec to before c1175c4ad01dbc9c979d099861fa90a754f72059Affected 959466588aa7f84ccf79ae36a1d89542eaf9aaec to before 51eb3b65544c9efd6a1026889ee5fb5aa62da3bbAffected
LinuxLinux	4.14Affected before 4.14Not affected 5.4.297 through 5.4.Not affected 5.10.241 through 5.10.Not affected 5.15.190 through 5.15.Not affected 6.1.138 through 6.1.Not affected 6.6.90 through 6.6.Not affected 6.12.28 through 6.12.Not affected 6.14.6 through 6.14.*Not affected 6.15 and laterNot affected

Product

Versions

LinuxLinux

959466588aa7f84ccf79ae36a1d89542eaf9aaec to before 9a5fd5c2f4d4afdd5e405083ee53e0789ce76956Affected
959466588aa7f84ccf79ae36a1d89542eaf9aaec to before 72c61ffbeeb8c50f6d4d70c65d3283aa1bac57a7Affected
959466588aa7f84ccf79ae36a1d89542eaf9aaec to before a5efc95a33bd4fcb879250852828cc58c7862970Affected
959466588aa7f84ccf79ae36a1d89542eaf9aaec to before 0475c85426b18eccdcb7f9fb58d8f8e9c6c58c87Affected
959466588aa7f84ccf79ae36a1d89542eaf9aaec to before 9030a91235ae4845ec71902c3e0cecfc9ed1f2dfAffected
959466588aa7f84ccf79ae36a1d89542eaf9aaec to before d06476714d2819b550e0cc39222347e2c8941c9dAffected
959466588aa7f84ccf79ae36a1d89542eaf9aaec to before c1175c4ad01dbc9c979d099861fa90a754f72059Affected
959466588aa7f84ccf79ae36a1d89542eaf9aaec to before 51eb3b65544c9efd6a1026889ee5fb5aa62da3bbAffected

LinuxLinux

4.14Affected
before 4.14Not affected
5.4.297 through 5.4.*Not affected
5.10.241 through 5.10.*Not affected
5.15.190 through 5.15.*Not affected
6.1.138 through 6.1.*Not affected
6.6.90 through 6.6.*Not affected
6.12.28 through 6.12.*Not affected
6.14.6 through 6.14.*Not affected
6.15 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.