CVE-2025-38193

What it actually does

The flaw permits negative or excessively large perturb_period values for the SFQ qdisc, allowing integer overflow in ctl->perturb_period * HZ and enabling a race condition in the Linux kernel scheduler.

Why it matters to the business

Local users on affected Linux systems could trigger scheduler instability or crashes during network traffic shaping, potentially disrupting service availability in environments relying on SFQ; low EPSS and no KEV listing indicate limited real-world exploitation risk despite mentions of related kernel privilege escalation campaigns.

How an attack unfolds

An attacker with local shell access issues a tc qdisc add command supplying an invalid negative or oversized perturb value to bypass missing range checks, attempting to trigger the race condition that a separate patch addresses; listed threat actors associated with other Linux kernel privilege escalations highlight similar local attack patterns.

How to fix it

Upgrade affected packages to newrelic-nri-statsd 2.11.0-r4 or apply the Linux kernel fix in commit e0936ff56be4e08ad5b60ec26971eae0c40af305; rebuild and deploy updated kernels across all distributions using SFQ.

How to confirm the fix worked

Confirm tc rejects negative values like -10 and oversized values like 1000000000 with 'invalid perturb period' error; verify running kernel contains the referenced commit and test valid large values like 2000000 are accepted without overflow.

Typical attack path

1. Gain local unprivileged access to a Linux host
2. Execute tc command with negative or oversized perturb value against SFQ qdisc
3. Trigger race condition leading to kernel instability

How to detect it

Review system logs and audit trails for failed or attempted tc qdisc commands referencing sch_sfq and perturb values; correlate with process execution of traffic control utilities on hosts running older kernels.

What your security team should do

• Prioritize kernel package updates on all production Linux systems within 30 days given published date and EPSS trend
• Audit configurations for use of SFQ qdisc and replace with safer alternatives where possible
• Enable kernel hardening features such as lockdown mode to limit local tc manipulation