Network Scheduling Vulnerability in Linux Kernel

CVE-2025-38468

What is CVE-2025-38468?

A vulnerability in the Linux kernel's network scheduling component can lead to erroneous behavior during packet handling. Specifically, when the htb_lookup_leaf function encounters an empty red-black tree, it triggers a BUG_ON condition. This can occur under particular network configurations involving multiple queuing disciplines, potentially resulting in null pointer dereferences that disrupt network operations. Returning NULL instead of triggering a BUG_ON can resolve this issue and prevent cascading failures in packet processing, improving overall system stability.

References