{"id":"CVE-2025-38115","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet_sched: sch_sfq: fix a potential crash on gso_skb handling\n\nSFQ has an assumption of always being able to queue at least one packet.\n\nHowever, after the blamed commi…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet_sched: sch_sfq: fix a potential crash on gso_skb handling\n\nSFQ has an assumption of always being able to queue at least one packet.\n\nHowever, after the blamed commi…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-401"],"vendor":"linux","product":"linux_kernel","affected":["linux_kernel >= 4.16, < 5.4.295","linux_kernel >= 5.5, < 5.10.239","linux_kernel >= 5.11, < 5.15.186","linux_kernel >= 5.16, < 6.1.142","linux_kernel >= 6.2, < 6.6.94","linux_kernel >= 6.7, < 6.12.34","linux_kernel >= 6.13, < 6.15.3","linux_kernel = 6.16","debian_linux = 11.0"],"patched":["linux_kernel 6.15.3"],"published":"2025-07-03","updated":"2026-10-15","sourceUpdated":"2026-10-15T22:18:27.983","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-38115","references":[{"url":"https://git.kernel.org/stable/c/5814a7fc3abb41f63f2d44c9d3ff9d4e62965b72","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/82448d4dcd8406dec688632a405fdcf7f170ec69","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/82ffbe7776d0ac084031f114167712269bf3d832","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9c19498bdd7cb9d854bd3c54260f71cf7408495e","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b44f791f27b14c9eb6b907fbe51f2ba8bec32085","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b4e9bab6011b9559b7c157b16b91ae46d4d8c533","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c337efb20d6d9f9bbb4746f6b119917af5c886dc","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d1bc80da75c789f2f6830df89d91fb2f7a509943","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html","label":"af854a3a-2127-422b-91ae-364da2661108"}],"tags":["nvd","cve.org"],"epss":0.00217,"epssPercentile":0.12127,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-15T21:47:38.082535Z"},"ingestedAt":"2026-10-15T22:48:25.493Z","slug":"CVE-2025-38115","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet_sched: sch_sfq: fix a potential crash on gso_skb handling\n\nSFQ has an assumption of always being able to queue at least one packet.\n\nHowever, after the blamed commit, sch->q.len can be inflated by packets\nin sch->gso_skb, and an enqueue() on an empty SFQ qdisc can be followed\nby an immediate drop.\n\nFix sfq_drop() to properly clear q->tail in this situation.\n\n\nip netns add lb\nip link add dev to-lb type veth peer name in-lb netns lb\nethtool -K to-lb tso off                 # force qdisc to requeue gso_skb\nip netns exec lb ethtool -K in-lb gro on # enable NAPI\nip link set dev to-lb up\nip -netns lb link set dev in-lb up\nip addr add dev to-lb 192.168.20.1/24\nip -netns lb addr add dev in-lb 192.168.20.2/24\ntc qdisc replace dev to-lb root sfq limit 100\n\nip netns exec lb netserver\n\nnetperf -H 192.168.20.2 -l 100 &\nnetperf -H 192.168.20.2 -l 100 &\nnetperf -H 192.168.20.2 -l 100 &\nnetperf -H 192.168.20.2 -l 100 &\n\n## Affected\n\n- `linux_kernel >= 4.16, < 5.4.295`\n- `linux_kernel >= 5.5, < 5.10.239`\n- `linux_kernel >= 5.11, < 5.15.186`\n- `linux_kernel >= 5.16, < 6.1.142`\n- `linux_kernel >= 6.2, < 6.6.94`\n- `linux_kernel >= 6.7, < 6.12.34`\n- `linux_kernel >= 6.13, < 6.15.3`\n- `linux_kernel = 6.16`\n- `debian_linux = 11.0`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `linux_kernel 6.15.3`","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}