CVE-2025-38115

What it actually does

The flaw in sch_sfq allows sch->q.len to be inflated by packets in sch->gso_skb after the referenced commit, violating the assumption that an enqueue on an empty SFQ qdisc is always possible and leading to an immediate drop; sfq_drop() fails to properly clear q->tail, resulting in memory corruption or kernel crash.

Why it matters to the business

Linux-based systems using the SFQ qdisc under network conditions involving GSO packets may experience kernel crashes and service disruption; widespread use of the Linux kernel in servers and cloud environments amplifies operational downtime risk, with urgency driven by the 481 days since publication and ongoing EPSS increase.

How an attack unfolds

An attacker configures a network namespace with veth interfaces, disables TSO, enables GRO, installs an SFQ qdisc, and sends concurrent traffic streams to trigger GSO skb requeuing that inflates queue length, causing the enqueue-then-drop condition and subsequent crash during sfq_drop processing.

How to fix it

Upgrade the Linux kernel to commit c337efb20d6d9f9bbb4746f6b119917af5c886dc or later; for eck-operator and eck-operator-compat upgrade to 3.0.0-r2 or later. Recompile and deploy the fixed kernel across affected distributions.

How to confirm the fix worked

Confirm presence of commit c337efb20d6d9f9bbb4746f6b119917af5c886dc in the running kernel source; reproduce the netns/veth/SFQ/netperf test scenario and verify no crash or tail pointer corruption occurs.

Typical attack path

1. Create network namespace and veth pair with specific ethtool settings for TSO/GRO
2. Replace root qdisc on interface with SFQ limited to 100
3. Launch multiple concurrent network performance test connections
4. Force GSO skb handling that inflates q->len beyond actual queue contents
5. Trigger enqueue on empty queue followed by immediate drop and tail pointer corruption

How to detect it

Search kernel logs and dmesg for panics or warnings referencing sch_sfq, sfq_drop, or gso_skb; correlate with network interface configuration changes and spikes in traffic from tools that generate concurrent streams.

What your security team should do

• Immediately apply the kernel commit or package update to all systems using SFQ qdisc
• Audit network configurations for SFQ usage combined with TSO/GRO settings
• Monitor EPSS trend and kernel mailing lists for related scheduler issues