CVE-2025-38177

What it actually does

The hfsc_qlen_notify() function in the HFSC qdisc scheduler was not idempotent, allowing repeated calls to incorrectly decrement cl_nactive counters and remove RB tree nodes without checks, leading to kernel memory corruption.

Why it matters to the business

Linux systems using advanced network traffic control may experience kernel crashes, instability, or privilege escalation, impacting server availability and security in containerized or cloud environments.

How an attack unfolds

An attacker with local access configures an HFSC qdisc and triggers repeated dequeue operations via fq_codel or similar to invoke the non-idempotent notify function, corrupting kernel structures for escalation or denial of service.

How to fix it

Upgrade affected Linux kernels to commit 9a5fd5c2f4d4afdd5e405083ee53e0789ce76956 or later; update Chainguard packages kubernetes-csi-external-attacher-fips and kubernetes-csi-external-attacher-fips-compat to 4.9.0-r1.

How to confirm the fix worked

Confirm kernel source includes RB_EMPTY_NODE() and RB_CLEAR_NODE() guards plus cl_nactive non-zero check before update_vf(); verify package versions match fixed releases.

Typical attack path

1. Obtain local user access on target Linux system
2. Set up HFSC qdisc scheduler on network interface
3. Generate traffic patterns that invoke repeated qlen_notify calls during dequeue
4. Trigger memory corruption in cl_nactive or el_node structures
5. Escalate to kernel privileges or induce system crash

How to detect it

Search kernel logs for HFSC-related oops, panics, or RB tree warnings during qdisc operations; examine system call traces involving qdisc_tree_reduce_backlog.

What your security team should do

• Apply kernel and package updates immediately on all Linux hosts using HFSC qdisc
• Review network qdisc configurations for unnecessary HFSC usage
• Monitor EPSS trend for any increase indicating rising exploit interest