CVE-2025-38115: debian linux — Fix

Description

In the Linux kernel, the following vulnerability has been resolved: net_sched: sch_sfq: fix a potential crash on gso_skb handling SFQ has an assumption of always being able to queue at least one packet. However, after the blamed commit, sch->q.len can be inflated by packets in sch->gso_skb, and an enqueue() on an empty SFQ qdisc can be followed by an immediate drop. Fix sfq_drop() to properly clear q->tail in this situation. ip netns add lb ip link add dev to-lb type veth peer name in-lb netns lb ethtool -K to-lb tso off # force qdisc to requeue gso_skb ip netns exec lb ethtool -K in-lb gro on # enable NAPI ip link set dev to-lb up ip -netns lb link set dev in-lb up ip addr add dev to-lb 192.168.20.1/24 ip -netns lb addr add dev in-lb 192.168.20.2/24 tc qdisc replace dev to-lb root sfq limit 100 ip netns exec lb netserver netperf -H 192.168.20.2 -l 100 & netperf -H 192.168.20.2 -l 100 & netperf -H 192.168.20.2 -l 100 & netperf -H 192.168.20.2 -l 100 &

Is your site exposed to CVE-2025-38115?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

5.5

MEDIUM

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness Type (CWE)

CWE-401 CWE-401

Affected Products

Vendor	Product	Versions
linux	linux_kernel	4.16 — 5.4.295
linux	linux_kernel	5.5 — 5.10.239
linux	linux_kernel	5.11 — 5.15.186
linux	linux_kernel	5.16 — 6.1.142
linux	linux_kernel	6.2 — 6.6.94
linux	linux_kernel	6.7 — 6.12.34
linux	linux_kernel	6.13 — 6.15.3
linux	linux_kernel	All
debian	debian_linux	All

References

Advisories & Patches

https://git.kernel.org/stable/c/5814a7fc3abb41f63f2d44c9d3ff9d4e62965b72 https://git.kernel.org/stable/c/82448d4dcd8406dec688632a405fdcf7f170ec69 https://git.kernel.org/stable/c/82ffbe7776d0ac084031f114167712269bf3d832 https://git.kernel.org/stable/c/9c19498bdd7cb9d854bd3c54260f71cf7408495e https://git.kernel.org/stable/c/b44f791f27b14c9eb6b907fbe51f2ba8bec32085 https://git.kernel.org/stable/c/b4e9bab6011b9559b7c157b16b91ae46d4d8c533 https://git.kernel.org/stable/c/c337efb20d6d9f9bbb4746f6b119917af5c886dc https://git.kernel.org/stable/c/d1bc80da75c789f2f6830df89d91fb2f7a509943

Other References

https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html

Frequently Asked Questions

What is CVE-2025-38115? +

In the Linux kernel, the following vulnerability has been resolved: net_sched: sch_sfq: fix a potential crash on gso_skb handling SFQ has an assumption of always being able to queue at least one packet. However, after the blamed commit, sch->q.len can be inflated by packets in sch->gso_skb, and an enqueue() on an empty SFQ qdisc can be followed by an immediate drop. Fix sfq_drop() to properly clear q->tail in this situation. ip netns add lb ip link add dev to-lb type veth peer name in-lb netns lb ethtool -K to-lb tso off # force qdisc to requeue gso_skb ip netns exec lb ethtool -K in-lb gro on # enable NAPI ip link set dev to-lb up ip -netns lb link set dev in-lb up ip addr add dev to-lb 192.168.20.1/24 ip -netns lb addr add dev in-lb 192.168.20.2/24 tc qdisc replace dev to-lb root sfq limit 100 ip netns exec lb netserver netperf -H 192.168.20.2 -l 100 & netperf -H 192.168.20.2 -l 100 & netperf -H 192.168.20.2 -l 100 & netperf -H 192.168.20.2 -l 100 & It has a CVSS v3.1 base score of 5.5 (MEDIUM).

How severe is CVE-2025-38115? +

CVE-2025-38115 has a CVSS v3.1 score of 5.5 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance.

What products are affected by CVE-2025-38115? +

CVE-2025-38115 affects products from debian, linux, specifically: debian_linux, linux_kernel. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2025-38115? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-0646

A denial-of-service security issue exists within the 1794-AENTR adapter due to improper memory handling of CIP protocol requests. This vulnerability …

CVE-2026-20746

Virtual attribute handling in Ping Identity PingDirectory in affected versions allows only authorized users to exhaust java memory heap when …

CVE-2026-53429

Missing Release of Memory after Effective Lifetime vulnerability in leandrocp mdex and mdex_native allows an attacker who controls a rendered …

CVE-2024-25450 8.8

imlib2 v1.9.1 was discovered to mishandle memory allocation in the function init_imlib_fonts().

CVE-2025-20133 8.6

A vulnerability in the management and VPN web servers of the Remote Access SSL VPN feature of Cisco Secure Firewall …

CVE-2025-20239 8.6

A vulnerability in the Internet Key Exchange Version 2 (IKEv2) feature of Cisco IOS Software, IOS XE Software, Secure Firewall …

CVE-2025-38115