Idempotent Fix for hfsc_qlen_notify in Linux Kernel Vulnerability
Summary
CVE-2025-38177: In the Linux kernel, the following vulnerability has been resolved: sch_hfsc: make hfsc_qlen_notify() idempotent hfsc_qlen_notify() is not idempotent either and not friendly to its callers, like fq_codel_dequeue(). Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interactions. It is known for its robustness and flexibility, supporting a wide range of devices and architectures. However, like any complex software, it is susceptible to vulnerabilities that can affect system performance and security. This specific vulnerability pertains to the hfsc_qlen_notify function, which is responsible for managing queue lengths in the Hierarchical Fair Service Curve (HFSC) queuing discipline.
Vulnerability Detail
The vulnerability identified as CVE-2025-38177 arises from the hfsc_qlen_notify function not being idempotent, which means that repeated calls to this function can lead to unintended side effects. This issue complicates the operations of its callers, such as fq_codel_dequeue, potentially leading to degraded performance or system instability. The vulnerability is rooted in the way the function interacts with the queue management system, particularly in how it handles the active queue length and node removal from the red-black tree structure.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. It is recommended to apply the patch as soon as it is available to mitigate any risks associated with this issue.
Conclusion
The CVE-2025-38177 vulnerability in the Linux kernel's hfsc_qlen_notify function poses significant risks to system performance and stability. Users are encouraged to update to the patched versions available for their respective Debian distributions to ensure their systems remain secure.
See every vulnerability recorded for linux →
FAQ
CVE-2025-38177 is a vulnerability in the Linux kernel related to the hfsc_qlen_notify function, which is not idempotent and can lead to performance issues.
This vulnerability can cause instability and degraded performance in systems utilizing the HFSC queuing discipline, particularly under heavy load.
Yes, patched versions are available for Debian 12 (6.1.139-1) and Debian 13 (6.12.29-1).
You can use Vulert, which monitors open-source vulnerabilities in your software using a manifest file. Visit Vulert Scanner to check your application without signup.
While there are no specific workarounds, it is advisable to monitor your system closely and apply the patch as soon as possible to mitigate risks.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
