Vulnerability-Lookup

GHSA-62HM-RHVJ-5P55

Vulnerability from github – Published: 2025-07-10 09:32 – Updated: 2025-11-20 00:31

Details

In the Linux kernel, the following vulnerability has been resolved:

octeontx2-pf: QOS: Refactor TC_HTB_LEAF_DEL_LAST callback

This patch addresses below issues,

Active traffic on the leaf node must be stopped before its send queue is reassigned to the parent. This patch resolves the issue by marking the node as 'Inner'.
During a system reboot, the interface receives TC_HTB_LEAF_DEL and TC_HTB_LEAF_DEL_LAST callbacks to delete its HTB queues. In the case of TC_HTB_LEAF_DEL_LAST, although the same send queue is reassigned to the parent, the current logic still attempts to update the real number of queues, leadning to below warnings
```
New queues can't be registered after device unregistration.
WARNING: CPU: 0 PID: 6475 at net/core/net-sysfs.c:1714
netdev_queue_update_kobjects+0x1e4/0x200
```

Severity

5.5 (Medium)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2025-38278"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-07-10T08:15:26Z",
    "severity": "MODERATE"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nocteontx2-pf: QOS: Refactor TC_HTB_LEAF_DEL_LAST callback\n\nThis patch addresses below issues,\n\n1. Active traffic on the leaf node must be stopped before its send queue\n   is reassigned to the parent. This patch resolves the issue by marking\n   the node as \u0027Inner\u0027.\n\n2. During a system reboot, the interface receives TC_HTB_LEAF_DEL\n   and TC_HTB_LEAF_DEL_LAST callbacks to delete its HTB queues.\n   In the case of TC_HTB_LEAF_DEL_LAST, although the same send queue\n   is reassigned to the parent, the current logic still attempts to update\n   the real number of queues, leadning to below warnings\n\n        New queues can\u0027t be registered after device unregistration.\n        WARNING: CPU: 0 PID: 6475 at net/core/net-sysfs.c:1714\n        netdev_queue_update_kobjects+0x1e4/0x200",
  "id": "GHSA-62hm-rhvj-5p55",
  "modified": "2025-11-20T00:31:20Z",
  "published": "2025-07-10T09:32:29Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-38278"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/5df8db01d6a4e9c35a5ba5d7e130d5cecd3ffcb4"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/67af4ec948e8ce3ea53a9cf614d01fddf172e56d"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/ec62c99914a79d84c8de5ba1b94d62f2ed721f2a"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/f1fca0eae5a0573f226f46c6871260278e7dda12"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2025-38278 (GCVE-0-2025-38278)

Vulnerability from cvelistv5 – Published: 2025-07-10 07:41 – Updated: 2026-08-05 12:00

Title

octeontx2-pf: QOS: Refactor TC_HTB_LEAF_DEL_LAST callback

Summary

In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: QOS: Refactor TC_HTB_LEAF_DEL_LAST callback This patch addresses below issues, 1. Active traffic on the leaf node must be stopped before its send queue is reassigned to the parent. This patch resolves the issue by marking the node as 'Inner'. 2. During a system reboot, the interface receives TC_HTB_LEAF_DEL and TC_HTB_LEAF_DEL_LAST callbacks to delete its HTB queues. In the case of TC_HTB_LEAF_DEL_LAST, although the same send queue is reassigned to the parent, the current logic still attempts to update the real number of queues, leadning to below warnings New queues can't be registered after device unregistration. WARNING: CPU: 0 PID: 6475 at net/core/net-sysfs.c:1714 netdev_queue_update_kobjects+0x1e4/0x200

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root Scorecard

References

4 references

URL	Tags
https://git.kernel.org/stable/c/5df8db01d6a4e9c35…
https://git.kernel.org/stable/c/ec62c99914a79d84c…
https://git.kernel.org/stable/c/f1fca0eae5a0573f2…
https://git.kernel.org/stable/c/67af4ec948e8ce3ea…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 5e6808b4c68d7882971514ab3279926eb07c8b2d , < 5df8db01d6a4e9c35a5ba5d7e130d5cecd3ffcb4 (git) Affected: 5e6808b4c68d7882971514ab3279926eb07c8b2d , < ec62c99914a79d84c8de5ba1b94d62f2ed721f2a (git) Affected: 5e6808b4c68d7882971514ab3279926eb07c8b2d , < f1fca0eae5a0573f226f46c6871260278e7dda12 (git) Affected: 5e6808b4c68d7882971514ab3279926eb07c8b2d , < 67af4ec948e8ce3ea53a9cf614d01fddf172e56d (git)
Linux	Linux	Affected: 6.5 Unaffected: 0 , < 6.5 (semver) Unaffected: 6.6.94 , ≤ 6.6.* (semver) Unaffected: 6.12.34 , ≤ 6.12.* (semver) Unaffected: 6.15.3 , ≤ 6.15.* (semver) Unaffected: 6.16 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/marvell/octeontx2/nic/qos.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5df8db01d6a4e9c35a5ba5d7e130d5cecd3ffcb4",
              "status": "affected",
              "version": "5e6808b4c68d7882971514ab3279926eb07c8b2d",
              "versionType": "git"
            },
            {
              "lessThan": "ec62c99914a79d84c8de5ba1b94d62f2ed721f2a",
              "status": "affected",
              "version": "5e6808b4c68d7882971514ab3279926eb07c8b2d",
              "versionType": "git"
            },
            {
              "lessThan": "f1fca0eae5a0573f226f46c6871260278e7dda12",
              "status": "affected",
              "version": "5e6808b4c68d7882971514ab3279926eb07c8b2d",
              "versionType": "git"
            },
            {
              "lessThan": "67af4ec948e8ce3ea53a9cf614d01fddf172e56d",
              "status": "affected",
              "version": "5e6808b4c68d7882971514ab3279926eb07c8b2d",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/marvell/octeontx2/nic/qos.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.5"
            },
            {
              "lessThan": "6.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.94",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.34",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.94",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.34",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.3",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nocteontx2-pf: QOS: Refactor TC_HTB_LEAF_DEL_LAST callback\n\nThis patch addresses below issues,\n\n1. Active traffic on the leaf node must be stopped before its send queue\n   is reassigned to the parent. This patch resolves the issue by marking\n   the node as \u0027Inner\u0027.\n\n2. During a system reboot, the interface receives TC_HTB_LEAF_DEL\n   and TC_HTB_LEAF_DEL_LAST callbacks to delete its HTB queues.\n   In the case of TC_HTB_LEAF_DEL_LAST, although the same send queue\n   is reassigned to the parent, the current logic still attempts to update\n   the real number of queues, leadning to below warnings\n\n        New queues can\u0027t be registered after device unregistration.\n        WARNING: CPU: 0 PID: 6475 at net/core/net-sysfs.c:1714\n        netdev_queue_update_kobjects+0x1e4/0x200"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable callback is reached through the tc/netlink qdisc configuration interface (RTM_DELTCLASS \u2192 htb_destroy_class_offload \u2192 TC_HTB_LEAF_DEL_LAST), which requires local access to a netlink socket. Per kernel scoring guidance, tc/netlink qdisc paths are Local.\nAC:L - The attacker controls both sides of the race \u2014 issuing the class deletion and concurrently transmitting traffic steered to that classid \u2014 and the window spans several synchronous AF mailbox round-trips (SMQ flush, context disable, NDC sync), making it trivially winnable. The second defect (the WARN on re-growing tx queues after unregistration) is fully deterministic and needs no race at all.\nPR:L - The path is gated only by netlink_net_capable(CAP_NET_ADMIN), which is satisfied by CAP_NET_ADMIN in the user namespace owning the network namespace and is therefore obtainable by an unprivileged user via unshare -Urn. octeontx2 VFs also register ndo_setup_tc, so a container or VM handed an SR-IOV VF \u2014 the standard OcteonTX2/CN10K DPU deployment \u2014 can reach this without any host privilege.\nUI:N - The attacker performs the class deletion and generates the concurrent traffic entirely on their own; no victim action is needed. The unregistration variant fires on any reboot or interface teardown that the attacker can also initiate themselves.\nS:U - The corruption and crash occur within the kernel\u0027s own security authority on the affected host, with no crossing of a VM, IOMMU, or sandbox boundary. This is a standard in-kernel memory-safety issue.\nC:H - The race yields a use-after-free on the send-queue resources (freed sq-\u003esqe, sq-\u003esg, sq-\u003esqb_ptrs, pool-\u003efc_addr) and on the RCU-looked-up qos node itself, which is kfree()d immediately after hash_del_rcu() with no grace period. UAF of these structures lets an attacker reclaim the slabs with controlled data and read back kernel memory contents, so High is appropriate.\nI:H - The transmit path writes into the freed memory \u2014 memset(sq-\u003esqe_base + 8, ...) and SG-descriptor stores into the freed sq-\u003esg \u2014 and the NIC subsequently DMAs into pages already put_page()d and dma_unmap()ed. This is an attacker-influenceable out-of-bounds/UAF write suitable for heap grooming and control-flow corruption.\nA:H - The use-after-free on freed DMA-coherent memory and released SQB pages causes oopses, IOMMU faults and NIC datapath wedging, and the second defect produces a WARN splat at net/core/net-sysfs.c on every unregistration, which is a full panic under panic_on_warn. Any such kernel crash is High."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:00:56.990Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5df8db01d6a4e9c35a5ba5d7e130d5cecd3ffcb4"
        },
        {
          "url": "https://git.kernel.org/stable/c/ec62c99914a79d84c8de5ba1b94d62f2ed721f2a"
        },
        {
          "url": "https://git.kernel.org/stable/c/f1fca0eae5a0573f226f46c6871260278e7dda12"
        },
        {
          "url": "https://git.kernel.org/stable/c/67af4ec948e8ce3ea53a9cf614d01fddf172e56d"
        }
      ],
      "title": "octeontx2-pf: QOS: Refactor TC_HTB_LEAF_DEL_LAST callback",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38278",
    "datePublished": "2025-07-10T07:41:57.546Z",
    "dateReserved": "2025-04-16T04:51:23.998Z",
    "dateUpdated": "2026-08-05T12:00:56.990Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

GHSA-62HM-RHVJ-5P55

CVE-2025-38278 (GCVE-0-2025-38278)

Tags

Sightings

Nomenclature

Related by attack behaviour