{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2025-38278", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T04:51:23.998Z", "datePublished": "2025-07-10T07:41:57.546Z", "dateUpdated": "2026-08-05T12:00:56.990Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:00:56.990Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nocteontx2-pf: QOS: Refactor TC_HTB_LEAF_DEL_LAST callback\n\nThis patch addresses below issues,\n\n1. Active traffic on the leaf node must be stopped before its send queue\n is reassigned to the parent. This patch resolves the issue by marking\n the node as 'Inner'.\n\n2. During a system reboot, the interface receives TC_HTB_LEAF_DEL\n and TC_HTB_LEAF_DEL_LAST callbacks to delete its HTB queues.\n In the case of TC_HTB_LEAF_DEL_LAST, although the same send queue\n is reassigned to the parent, the current logic still attempts to update\n the real number of queues, leadning to below warnings\n\n New queues can't be registered after device unregistration.\n WARNING: CPU: 0 PID: 6475 at net/core/net-sysfs.c:1714\n netdev_queue_update_kobjects+0x1e4/0x200" } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The vulnerable callback is reached through the tc/netlink qdisc configuration interface (RTM_DELTCLASS → htb_destroy_class_offload → TC_HTB_LEAF_DEL_LAST), which requires local access to a netlink socket. Per kernel scoring guidance, tc/netlink qdisc paths are Local.\nAC:L - The attacker controls both sides of the race — issuing the class deletion and concurrently transmitting traffic steered to that classid — and the window spans several synchronous AF mailbox round-trips (SMQ flush, context disable, NDC sync), making it trivially winnable. The second defect (the WARN on re-growing tx queues after unregistration) is fully deterministic and needs no race at all.\nPR:L - The path is gated only by netlink_net_capable(CAP_NET_ADMIN), which is satisfied by CAP_NET_ADMIN in the user namespace owning the network namespace and is therefore obtainable by an unprivileged user via unshare -Urn. octeontx2 VFs also register ndo_setup_tc, so a container or VM handed an SR-IOV VF — the standard OcteonTX2/CN10K DPU deployment — can reach this without any host privilege.\nUI:N - The attacker performs the class deletion and generates the concurrent traffic entirely on their own; no victim action is needed. The unregistration variant fires on any reboot or interface teardown that the attacker can also initiate themselves.\nS:U - The corruption and crash occur within the kernel's own security authority on the affected host, with no crossing of a VM, IOMMU, or sandbox boundary. This is a standard in-kernel memory-safety issue.\nC:H - The race yields a use-after-free on the send-queue resources (freed sq->sqe, sq->sg, sq->sqb_ptrs, pool->fc_addr) and on the RCU-looked-up qos node itself, which is kfree()d immediately after hash_del_rcu() with no grace period. UAF of these structures lets an attacker reclaim the slabs with controlled data and read back kernel memory contents, so High is appropriate.\nI:H - The transmit path writes into the freed memory — memset(sq->sqe_base + 8, ...) and SG-descriptor stores into the freed sq->sg — and the NIC subsequently DMAs into pages already put_page()d and dma_unmap()ed. This is an attacker-influenceable out-of-bounds/UAF write suitable for heap grooming and control-flow corruption.\nA:H - The use-after-free on freed DMA-coherent memory and released SQB pages causes oopses, IOMMU faults and NIC datapath wedging, and the second defect produces a WARN splat at net/core/net-sysfs.c on every unregistration, which is a full panic under panic_on_warn. Any such kernel crash is High." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/ethernet/marvell/octeontx2/nic/qos.c" ], "versions": [ { "version": "5e6808b4c68d7882971514ab3279926eb07c8b2d", "lessThan": "5df8db01d6a4e9c35a5ba5d7e130d5cecd3ffcb4", "status": "affected", "versionType": "git" }, { "version": "5e6808b4c68d7882971514ab3279926eb07c8b2d", "lessThan": "ec62c99914a79d84c8de5ba1b94d62f2ed721f2a", "status": "affected", "versionType": "git" }, { "version": "5e6808b4c68d7882971514ab3279926eb07c8b2d", "lessThan": "f1fca0eae5a0573f226f46c6871260278e7dda12", "status": "affected", "versionType": "git" }, { "version": "5e6808b4c68d7882971514ab3279926eb07c8b2d", "lessThan": "67af4ec948e8ce3ea53a9cf614d01fddf172e56d", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/ethernet/marvell/octeontx2/nic/qos.c" ], "versions": [ { "version": "6.5", "status": "affected" }, { "version": "0", "lessThan": "6.5", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.94", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.34", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.15.3", "lessThanOrEqual": "6.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.16", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.5", "versionEndExcluding": "6.6.94" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.5", "versionEndExcluding": "6.12.34" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.5", "versionEndExcluding": "6.15.3" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.5", "versionEndExcluding": "6.16" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/5df8db01d6a4e9c35a5ba5d7e130d5cecd3ffcb4" }, { "url": "https://git.kernel.org/stable/c/ec62c99914a79d84c8de5ba1b94d62f2ed721f2a" }, { "url": "https://git.kernel.org/stable/c/f1fca0eae5a0573f226f46c6871260278e7dda12" }, { "url": "https://git.kernel.org/stable/c/67af4ec948e8ce3ea53a9cf614d01fddf172e56d" } ], "title": "octeontx2-pf: QOS: Refactor TC_HTB_LEAF_DEL_LAST callback", "x_generator": { "engine": "bippy-1.2.0" } } } }