CVE-2025-38000

What it actually does

Incorrect queue length and backlog accounting in HFSC qdisc when child peek() triggers immediate dequeue or drop before qlen update, leaving empty classes on active list and enabling use-after-free.

Why it matters to the business

Linux systems using HFSC traffic control may experience kernel instability, crashes, or local privilege escalation leading to service disruption and potential full host compromise; low EPSS and no KEV status reduce immediate urgency but long publication window (508 days) and listed threat actor interest in similar kernel issues warrant attention.

How an attack unfolds

An attacker with local access crafts traffic or qdisc configurations to enqueue the first packet into an HFSC class, triggering the peek path in qdisc_peek_dequeued that causes drop or dequeue before accounting updates, resulting in inconsistent state that can be leveraged for use-after-free; context from Advanced Spyware Campaign and 2024 Zero-Day Exploitation Campaigns by Espionage and Financially Motivated Actors plus related CVEs like CVE-2025-37797 indicates targeted interest in kernel queueing flaws.

How to fix it

Upgrade to fixed kernel versions containing commit 1034e3310752e8675e313f7271b348914008719a; for listed jbigkit packages apply 2.0-2ubuntu4.1+esm1 (14.04), 2.1-3.1ubuntu0.1~esm1 (16.04), 2.1-3.1ubuntu0.18.04.1 (18.04), 2.1-3.1ubuntu0.20.04.1 (20.04), or 2.1-3.1ubuntu0.22.04.1 (22.04) where applicable.

How to confirm the fix worked

Confirm kernel contains the referenced commit or package versions above; inspect HFSC enqueue paths for qlen increment preceding peek() call and test with crafted first-packet enqueue scenarios.

Typical attack path

1. Obtain local code execution or shell on Linux host
2. Configure or attach HFSC qdisc with child using qdisc_peek_dequeued
3. Enqueue first packet to trigger peek before qlen increment
4. Force drop or dequeue path invoking qdisc_tree_reduce_backlog on stale state
5. Exploit resulting empty active class for use-after-free

How to detect it

Review kernel logs for HFSC-related use-after-free warnings or oops after qdisc operations; correlate with threat actor TTPs around Linux kernel privilege escalation listed in input.

What your security team should do

• Prioritize kernel updates on all systems using HFSC qdisc
• Monitor for similar queue accounting issues in other qdiscs
• Limit unprivileged local access until patched given listed espionage and financial actor interest