Linux Kernel Vulnerability in Qdisc API Affects Networking Functionality

CVE-2025-38457

What is CVE-2025-38457?

A vulnerability exists within the Linux kernel's Qdisc API where improper handling of class relationships during qdisc creation can allow certain Qdiscs to invoke qdisc_tree_reduce_backlog with a null class reference. This bug arises when the qdisc API fails to validate the existence of the parent class before execution of the init callback. The resolution involves modifying the behavior of qdisc_leaf to ensure that it returns failure when the parent class is not found, preventing potential misconfigurations and operational disruptions in networking scenarios.

References