CVE-2025-38000

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue()<br /> <br /> When enqueuing the first packet to an HFSC class, hfsc_enqueue() calls the<br /> child qdisc&amp;#39;s peek() operation before incrementing sch-&gt;q.qlen and<br /> sch-&gt;qstats.backlog. If the child qdisc uses qdisc_peek_dequeued(), this may<br /> trigger an immediate dequeue and potential packet drop. In such cases,<br /> qdisc_tree_reduce_backlog() is called, but the HFSC qdisc&amp;#39;s qlen and backlog<br /> have not yet been updated, leading to inconsistent queue accounting. This<br /> can leave an empty HFSC class in the active list, causing further<br /> consequences like use-after-free.<br /> <br /> This patch fixes the bug by moving the increment of sch-&gt;q.qlen and<br /> sch-&gt;qstats.backlog before the call to the child qdisc&amp;#39;s peek() operation.<br /> This ensures that queue length and backlog are always accurate when packet<br /> drops or dequeues are triggered during the peek.