Critical Vulnerability in Linux Kernel: Netem Duplication Prevention Flaw
Summary
CVE-2025-38553: In the Linux kernel, the following vulnerability has been resolved: net/sched: Restrict conditions for adding duplicating netems to qdisc tree netem_enqueue's duplication prevention logic breaks when a netem resides in a... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, managing hardware and system resources. It provides essential services for all other software running on the system. The kernel's networking subsystem includes netem, a network emulator that allows for the simulation of various network conditions. This vulnerability affects the netem functionality, specifically its ability to prevent duplicate entries in the queuing discipline (qdisc) tree, which can lead to severe performance issues.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the netem module, where the duplication prevention logic fails when a netem instance is placed in a qdisc tree alongside other netems. This flaw can result in a soft lockup and an out-of-memory (OOM) loop during the netem_dequeue process. The vulnerability arises from the inability to track and restrict the addition of duplicate netems within the same qdisc tree, leading to potential denial-of-service conditions.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid adding multiple netem instances to the same qdisc tree. This can prevent the occurrence of the duplication issue until a patch is applied.
Conclusion
The vulnerability in the Linux kernel's netem module poses significant risks to system stability and network performance. Users are strongly advised to update their kernel to the latest version to mitigate these risks. Temporary workarounds can help manage the issue until a full update is performed.
See every vulnerability recorded for linux →
FAQ
The vulnerability can lead to system instability, causing soft lockups and out-of-memory conditions, which may disrupt network services.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability.
Yes, a patch has been released in the latest versions of the Linux kernel. Users should update their kernel to the patched version.
Netem is a network emulator in the Linux kernel that allows users to simulate various network conditions such as delay, loss, and duplication.
If an immediate update is not possible, avoid using multiple netem instances in the same qdisc tree as a temporary measure to mitigate the risk.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
