Critical Vulnerability in Linux Kernel: octeontx2-pf QOS Callback Issue
Summary
DEBIAN-CVE-2025-38278: In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: QOS: Refactor TC_HTB_LEAF_DEL_LAST callback This patch addresses below issues, 1. Affects linux versions < 6.12.35-1. Fixed in 6.12.35-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware management and system operations. It is known for its robustness and flexibility, supporting a wide range of hardware architectures. However, vulnerabilities can arise, impacting system stability and security. This specific vulnerability affects the Linux kernel versions in Debian 13 and 14, highlighting issues in the octeontx2-pf driver related to Quality of Service (QOS) callbacks.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the octeontx2-pf driver concerning the handling of QOS callbacks. The issue arises when active traffic on a leaf node is not properly stopped before its send queue is reassigned to the parent node. This can lead to warnings during system reboot, where the interface receives callbacks to delete its HTB queues. The current logic attempts to update the number of queues even after device unregistration, resulting in potential system instability and warnings that can hinder performance.
How To Fix
Minimum fixed version
6.12.35-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, no specific workarounds are provided for this vulnerability. It is advisable to apply the patch as soon as it is available to mitigate any potential risks associated with this issue.
Conclusion
The identified vulnerability in the Linux kernel's octeontx2-pf driver poses significant risks related to system stability and performance. It is essential for users to update their systems to the patched version to mitigate these risks. Utilizing tools like Vulert can further enhance security by providing real-time monitoring of vulnerabilities.
See every vulnerability recorded for linux →
FAQ
The vulnerability involves improper handling of QOS callbacks in the octeontx2-pf driver, which can lead to system warnings and instability.
The vulnerability affects Linux kernel versions in Debian 13 and 14 prior to the patch version 6.12.35-1.
You can use tools like Vulert, which monitors open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without any signup.
While no specific workarounds are available, it is crucial to monitor the situation and apply the patch as soon as it is released.
Vulert uses a manifest file like package-lock.json to monitor and alert in real-time for open-source vulnerabilities in your software, ensuring you stay informed about potential risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
