CVE-2025-38193

Q: What is the severity of CVE-2025-38193?

CVE-2025-38193 has a CVSS score of 5.5 (MEDIUM). A vulnerability in the Linux kernel's SFQ (Stochastic Fairness Queueing) scheduler allows attackers to trigger a race condition by providing invalid perturb_period values. This integer overflow/underflow vulnerability affects Linux systems using SFQ queuing discipline. Attackers with local or network access to configure traffic control rules could potentially exploit this.

5.5 MEDIUM

Denial of Service

📋 TL;DR

A vulnerability in the Linux kernel's SFQ (Stochastic Fairness Queueing) scheduler allows attackers to trigger a race condition by providing invalid perturb_period values. This integer overflow/underflow vulnerability affects Linux systems using SFQ queuing discipline. Attackers with local or network access to configure traffic control rules could potentially exploit this.

💻 Affected Systems

Products:

Linux kernel

Versions: Specific affected versions not specified in CVE, but patches available for multiple stable branches

Operating Systems: Linux distributions using vulnerable kernel versions

Default Config Vulnerable: ✅ No

Notes: Only affects systems using SFQ queuing discipline. Requires ability to configure traffic control rules (typically requires root or CAP_NET_ADMIN)

📦 What is this software?

Debian Linux by Debian

View all CVEs affecting Debian Linux →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic or denial of service leading to system instability or crash

🟠

Likely Case

Local denial of service through kernel instability or system hang

🟢

If Mitigated

No impact if SFQ is not used or proper input validation is in place

🌐 Internet-Facing: LOW - Requires ability to configure network queuing, typically requires local access or specific network configuration capabilities

🏢 Internal Only: MEDIUM - Internal users with traffic control permissions could cause system instability

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Exploitation requires ability to configure traffic control rules and knowledge of triggering race condition

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Multiple stable kernel versions with commits: 0357da9149eac621f39e235a135ebf155f01f7c3, 2254d038dab9c194fe6a4b1ce31034f42e91a6e5, 590b2d7d0beadba2aa576708a05a05f0aae39295, 7ca52541c05c832d32b112274f81a985101f9ba8, 956b5aebb349449b38d920d444ca1392d43719d1

Vendor Advisory: https://git.kernel.org/stable/c/0357da9149eac621f39e235a135ebf155f01f7c3

Restart Required: Yes

Instructions:

1. Update Linux kernel to patched version. 2. Check distribution-specific security advisories. 3. Reboot system after kernel update.

🔧 Temporary Workarounds

Disable SFQ usage

linux

Prevent use of SFQ queuing discipline if not required

# Remove existing SFQ qdiscs
tc qdisc del dev [interface] root
# Monitor for SFQ usage attempts

Restrict traffic control permissions

linux

Limit who can configure network queuing disciplines

# Remove CAP_NET_ADMIN from non-privileged users
setcap -r /sbin/tc
# Use sudoers to restrict tc command

🧯 If You Can't Patch

Restrict access to traffic control utilities (tc command) to trusted administrators only
Monitor for attempts to configure SFQ with unusual perturb values

🔍 How to Verify

Check if Vulnerable:

Check if SFQ qdiscs are configured: tc -s qdisc show | grep sfq

Check Version:

uname -r

Verify Fix Applied:

Check kernel version is patched: uname -r and verify against distribution security advisories

📡 Detection & Monitoring

Log Indicators:

Failed tc command attempts with SFQ parameters
Kernel logs showing SFQ configuration errors

Network Indicators:

Unusual traffic control configuration attempts

SIEM Query:

Process execution: tc with sfq and perturb parameters

📊 Metadata

CVE ID: CVE-2025-38193

CVSS v3 Score: 5.5 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-190

EPSS Score: 0.01% exploit probability (2.2th percentile)

Published: July 4, 2025

Last Updated: December 18, 2025

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Debian Linux by Debian

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Disable SFQ usage

Restrict traffic control permissions

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export

🔗 Related Vulnerabilities