Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2025-38468— net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于htb_lookup_leaf遇到空rbtree时未返回NULL。

AI Predicted 5.5 Difficulty: Moderate EPSS 0.18% · P7

Possible ATT&CK Techniques 1 AI

T1499 · Endpoint Denial of Service

Affected Version Matrix 18

VendorProduct Version RangeStatus
Linux Linux 512bb43eb5422ee69a1be05ea0d89dc074fac9a2< fed3570e548a6c9f95c5f4c9e1a7afc1679fd90d affected
512bb43eb5422ee69a1be05ea0d89dc074fac9a2< 5c0506cd1b1a3b145bda2612bbf7fe78d186c355 affected
512bb43eb5422ee69a1be05ea0d89dc074fac9a2< 850226aef8d28a00cf966ef26d2f8f2bff344535 affected
512bb43eb5422ee69a1be05ea0d89dc074fac9a2< 890a5d423ef0a7bd13447ceaffad21189f557301 affected
512bb43eb5422ee69a1be05ea0d89dc074fac9a2< 7ff2d83ecf2619060f30ecf9fad4f2a700fca344 affected
512bb43eb5422ee69a1be05ea0d89dc074fac9a2< e5c480dc62a3025b8428d4818e722da30ad6804f affected
512bb43eb5422ee69a1be05ea0d89dc074fac9a2< 3691f84269a23f7edd263e9b6edbc27b7ae332f4 affected
512bb43eb5422ee69a1be05ea0d89dc074fac9a2< 0e1d5d9b5c5966e2e42e298670808590db5ed628 affected
… +10 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2025-38468

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree htb_lookup_leaf has a BUG_ON that can trigger with the following: tc qdisc del dev lo root tc qdisc add dev lo root handle 1: htb default 1 tc class add dev lo parent 1: classid 1:1 htb rate 64bit tc qdisc add dev lo parent 1:1 handle 2: netem tc qdisc add dev lo parent 2:1 handle 3: blackhole ping -I lo -c1 -W0.001 127.0.0.1 The root cause is the following: 1. htb_dequeue calls htb_dequeue_tree which calls the dequeue handler on the selected leaf qdisc 2. netem_dequeue calls enqueue on the child qdisc 3. blackhole_enqueue drops the packet and returns a value that is not just NET_XMIT_SUCCESS 4. Because of this, netem_dequeue calls qdisc_tree_reduce_backlog, and since qlen is now 0, it calls htb_qlen_notify -> htb_deactivate -> htb_deactiviate_prios -> htb_remove_class_from_row -> htb_safe_rb_erase 5. As this is the only class in the selected hprio rbtree, __rb_change_child in __rb_erase_augmented sets the rb_root pointer to NULL 6. Because blackhole_dequeue returns NULL, netem_dequeue returns NULL, which causes htb_dequeue_tree to call htb_lookup_leaf with the same hprio rbtree, and fail the BUG_ON The function graph for this scenario is shown here: 0) | htb_enqueue() { 0) + 13.635 us | netem_enqueue(); 0) 4.719 us | htb_activate_prios(); 0) # 2249.199 us | } 0) | htb_dequeue() { 0) 2.355 us | htb_lookup_leaf(); 0) | netem_dequeue() { 0) + 11.061 us | blackhole_enqueue(); 0) | qdisc_tree_reduce_backlog() { 0) | qdisc_lookup_rcu() { 0) 1.873 us | qdisc_match_from_root(); 0) 6.292 us | } 0) 1.894 us | htb_search(); 0) | htb_qlen_notify() { 0) 2.655 us | htb_deactivate_prios(); 0) 6.933 us | } 0) + 25.227 us | } 0) 1.983 us | blackhole_dequeue(); 0) + 86.553 us | } 0) # 2932.761 us | qdisc_warn_nonwc(); 0) | htb_lookup_leaf() { 0) | BUG_ON(); ------------------------------------------ The full original bug report can be seen here [1]. We can fix this just by returning NULL instead of the BUG_ON, as htb_dequeue_tree returns NULL when htb_lookup_leaf returns NULL. [1] https://lore.kernel.org/netdev/pF5XOOIim0IuEfhI-SOxTgRvNoDwuux7UHKnE_Y5-zVd4wmGvNk2ceHjKb8ORnzw0cGwfmVu42g9dL7XyJLf1NEzaztboTWcm0Ogxuojoeo=@willsroot.io/
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于htb_lookup_leaf遇到空rbtree时未返回NULL。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 512bb43eb5422ee69a1be05ea0d89dc074fac9a2 ~ fed3570e548a6c9f95c5f4c9e1a7afc1679fd90d -
Linux Linux 2.6.29 -

II. Public POCs for CVE-2025-38468

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2025-38468

请登录查看更多情报信息。

Patches & Fixes for CVE-2025-38468 (1)

Same Patch Batch · Linux · 2025-07-28 · 29 CVEs total

CVE-2025-38471 9.8 CRITICAL tls: always refresh the queue when reading sock
CVE-2025-38472 9.8 CRITICAL netfilter: nf_conntrack: fix crash due to removal of uninitialised entry
CVE-2025-38490 9.8 CRITICAL net: libwx: remove duplicate page_pool_put_full_page()
CVE-2025-38476 9.8 CRITICAL rpl: Fix use-after-free in rpl_do_srh_inline().
CVE-2025-38488 9.8 CRITICAL smb: client: fix use-after-free in crypt_message when using async crypto
CVE-2025-38495 8.8 HIGH HID: core: ensure the allocated report buffer can contain the reserved report ID
CVE-2025-38491 8.2 HIGH mptcp: make fallback action and fallback decision atomic
CVE-2025-38470 7.8 HIGH net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime
CVE-2025-38494 7.8 HIGH HID: core: do not bypass hid_hw_raw_request
CVE-2025-38485 7.8 HIGH iio: accel: fxls8962af: Fix use after free in fxls8962af_fifo_flush
CVE-2025-38486 7.8 HIGH soundwire: Revert "soundwire: qcom: Add set_channel_map api support"
CVE-2025-38484 7.8 HIGH iio: backend: fix out-of-bound write
CVE-2025-38478 7.8 HIGH comedi: Fix initialization of data for instructions that write to subdevice
CVE-2025-38477 7.8 HIGH net/sched: sch_qfq: Fix race condition on qfq_aggregate
CVE-2025-38475 7.8 HIGH smc: Fix various oops due to inet_sock type confusion.
CVE-2025-38482 comedi: das6402: Fix bit shift out of bounds
CVE-2025-38483 comedi: das16m1: Fix bit shift out of bounds
CVE-2025-38481 comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large
CVE-2025-38480 comedi: Fix use of uninitialized data in insn_rw_emulate_bits()
CVE-2025-38487 soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled

Showing top 20 of 29 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2025-38468

No comments yet

Leave a comment