Critical Vulnerability in Linux Kernel Affecting Debian Packages
Summary
CVE-2025-38457: In the Linux kernel, the following vulnerability has been resolved: net/sched: Abort __tc_modify_qdisc if parent class does not exist Lion's patch [1] revealed an ancient bug in the qdisc API. Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Debian operating system, responsible for managing hardware and system resources. It provides essential services for all other software running on the system. This vulnerability affects multiple versions of the Linux package across Debian 11, 12, and 13, highlighting a significant flaw in the qdisc API that can lead to system instability.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the net/sched subsystem related to the qdisc API. The issue arises when a user attempts to create or modify a queuing discipline (qdisc) that specifies a non-existent parent class. The qdisc API fails to abort the operation before executing critical initialization callbacks, leading to potential system crashes or undefined behavior. This flaw can be exploited by executing specific commands that manipulate the qdisc structure, resulting in a failure to find the child class and invoking functions with null references.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid creating or modifying qdiscs with non-existent parent classes until the patch is applied. This can be done by verifying the existence of the parent class before executing qdisc commands.
Conclusion
The vulnerability CVE-2025-38457 in the Linux kernel poses a significant risk to Debian users by potentially leading to system instability. It is crucial for users to update their Linux packages to the patched versions and to follow best practices in managing qdiscs to mitigate this risk. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for linux →
FAQ
CVE-2025-38457 is a vulnerability in the Linux kernel's qdisc API that can lead to system instability when creating or modifying qdiscs with non-existent parent classes.
You can use Vulert, which monitors open-source vulnerabilities in your software. By simply providing a manifest file like package-lock.json, you can check for vulnerabilities without needing to install any software.
Exploiting this vulnerability can lead to system crashes, undefined behavior, and potential denial of service, affecting the stability of the operating system.
Yes, a patch has been released for the affected versions of the Linux package. Users should update to the latest version to mitigate the risk.
You can use Vulert's playground to monitor your applications for vulnerabilities in real-time without any signup. This tool provides alerts for open-source vulnerabilities as they are discovered.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
