---
id: CVE-2025-38468
title: 'net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree

  htb_lookup_leaf has a BUG_ON that can trigger with the following:

  tc qdisc del dev lo root
  tc q…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 512bb43eb5422ee69a1be05ea0d89dc074fac9a2 <
    fed3570e548a6c9f95c5f4c9e1a7afc1679fd90d
  - >-
    Linux >= 512bb43eb5422ee69a1be05ea0d89dc074fac9a2 <
    5c0506cd1b1a3b145bda2612bbf7fe78d186c355
  - >-
    Linux >= 512bb43eb5422ee69a1be05ea0d89dc074fac9a2 <
    850226aef8d28a00cf966ef26d2f8f2bff344535
  - >-
    Linux >= 512bb43eb5422ee69a1be05ea0d89dc074fac9a2 <
    890a5d423ef0a7bd13447ceaffad21189f557301
  - >-
    Linux >= 512bb43eb5422ee69a1be05ea0d89dc074fac9a2 <
    7ff2d83ecf2619060f30ecf9fad4f2a700fca344
  - >-
    Linux >= 512bb43eb5422ee69a1be05ea0d89dc074fac9a2 <
    e5c480dc62a3025b8428d4818e722da30ad6804f
  - >-
    Linux >= 512bb43eb5422ee69a1be05ea0d89dc074fac9a2 <
    3691f84269a23f7edd263e9b6edbc27b7ae332f4
  - >-
    Linux >= 512bb43eb5422ee69a1be05ea0d89dc074fac9a2 <
    0e1d5d9b5c5966e2e42e298670808590db5ed628
  - Linux 2.6.29
published: '2025-07-28'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T01:07:21.684Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-38468'
references:
  - url: 'https://git.kernel.org/stable/c/fed3570e548a6c9f95c5f4c9e1a7afc1679fd90d'
  - url: 'https://git.kernel.org/stable/c/5c0506cd1b1a3b145bda2612bbf7fe78d186c355'
  - url: 'https://git.kernel.org/stable/c/850226aef8d28a00cf966ef26d2f8f2bff344535'
  - url: 'https://git.kernel.org/stable/c/890a5d423ef0a7bd13447ceaffad21189f557301'
  - url: 'https://git.kernel.org/stable/c/7ff2d83ecf2619060f30ecf9fad4f2a700fca344'
  - url: 'https://git.kernel.org/stable/c/e5c480dc62a3025b8428d4818e722da30ad6804f'
  - url: 'https://git.kernel.org/stable/c/3691f84269a23f7edd263e9b6edbc27b7ae332f4'
  - url: 'https://git.kernel.org/stable/c/0e1d5d9b5c5966e2e42e298670808590db5ed628'
tags:
  - cve.org
epss: 0.00183
epssPercentile: 0.07785
ingestedAt: '2026-10-15T05:52:46.086Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree

htb_lookup_leaf has a BUG_ON that can trigger with the following:

tc qdisc del dev lo root
tc qdisc add dev lo root handle 1: htb default 1
tc class add dev lo parent 1: classid 1:1 htb rate 64bit
tc qdisc add dev lo parent 1:1 handle 2: netem
tc qdisc add dev lo parent 2:1 handle 3: blackhole
ping -I lo -c1 -W0.001 127.0.0.1

The root cause is the following:

1. htb_dequeue calls htb_dequeue_tree which calls the dequeue handler on
   the selected leaf qdisc
2. netem_dequeue calls enqueue on the child qdisc
3. blackhole_enqueue drops the packet and returns a value that is not
   just NET_XMIT_SUCCESS
4. Because of this, netem_dequeue calls qdisc_tree_reduce_backlog, and
   since qlen is now 0, it calls htb_qlen_notify -> htb_deactivate ->
   htb_deactiviate_prios -> htb_remove_class_from_row -> htb_safe_rb_erase
5. As this is the only class in the selected hprio rbtree,
   __rb_change_child in __rb_erase_augmented sets the rb_root pointer to
   NULL
6. Because blackhole_dequeue returns NULL, netem_dequeue returns NULL,
   which causes htb_dequeue_tree to call htb_lookup_leaf with the same
   hprio rbtree, and fail the BUG_ON

The function graph for this scenario is shown here:
 0)               |  htb_enqueue() {
 0) + 13.635 us   |    netem_enqueue();
 0)   4.719 us    |    htb_activate_prios();
 0) # 2249.199 us |  }
 0)               |  htb_dequeue() {
 0)   2.355 us    |    htb_lookup_leaf();
 0)               |    netem_dequeue() {
 0) + 11.061 us   |      blackhole_enqueue();
 0)               |      qdisc_tree_reduce_backlog() {
 0)               |        qdisc_lookup_rcu() {
 0)   1.873 us    |          qdisc_match_from_root();
 0)   6.292 us    |        }
 0)   1.894 us    |        htb_search();
 0)               |        htb_qlen_notify() {
 0)   2.655 us    |          htb_deactivate_prios();
 0)   6.933 us    |        }
 0) + 25.227 us   |      }
 0)   1.983 us    |      blackhole_dequeue();
 0) + 86.553 us   |    }
 0) # 2932.761 us |    qdisc_warn_nonwc();
 0)               |    htb_lookup_leaf() {
 0)               |      BUG_ON();
 ------------------------------------------

The full original bug report can be seen here [1].

We can fix this just by returning NULL instead of the BUG_ON,
as htb_dequeue_tree returns NULL when htb_lookup_leaf returns
NULL.

[1] https://lore.kernel.org/netdev/pF5XOOIim0IuEfhI-SOxTgRvNoDwuux7UHKnE_Y5-zVd4wmGvNk2ceHjKb8ORnzw0cGwfmVu42g9dL7XyJLf1NEzaztboTWcm0Ogxuojoeo=@willsroot.io/

## Affected

- `Linux >= 512bb43eb5422ee69a1be05ea0d89dc074fac9a2 < fed3570e548a6c9f95c5f4c9e1a7afc1679fd90d`
- `Linux >= 512bb43eb5422ee69a1be05ea0d89dc074fac9a2 < 5c0506cd1b1a3b145bda2612bbf7fe78d186c355`
- `Linux >= 512bb43eb5422ee69a1be05ea0d89dc074fac9a2 < 850226aef8d28a00cf966ef26d2f8f2bff344535`
- `Linux >= 512bb43eb5422ee69a1be05ea0d89dc074fac9a2 < 890a5d423ef0a7bd13447ceaffad21189f557301`
- `Linux >= 512bb43eb5422ee69a1be05ea0d89dc074fac9a2 < 7ff2d83ecf2619060f30ecf9fad4f2a700fca344`
- `Linux >= 512bb43eb5422ee69a1be05ea0d89dc074fac9a2 < e5c480dc62a3025b8428d4818e722da30ad6804f`
- `Linux >= 512bb43eb5422ee69a1be05ea0d89dc074fac9a2 < 3691f84269a23f7edd263e9b6edbc27b7ae332f4`
- `Linux >= 512bb43eb5422ee69a1be05ea0d89dc074fac9a2 < 0e1d5d9b5c5966e2e42e298670808590db5ed628`
- `Linux 2.6.29`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.