Linux ETS Scheduler Flaw Enables Local Kernel Denial of Service
Vulnerability Disclosure · 2 sources · Updated 3mo ago · First seen Sep 8, 2025
CVE-2025-38684 is a moderate-severity flaw in the Linux kernel's Enhanced Transmission Selection (ETS) traffic-control scheduler. A faulty update sequence in ets_qdisc_change() updates q->nbands before unused DWRR classes are purged, leaving cleanup logic to operate on an inconsistent ETS configuration and potentially dereference a NULL pointer. A local attacker can trigger a kernel crash, resulting in denial of service; Red Hat rates the issue CVSS 5.2, while NVD assigns 5.5.
Red Hat has released fixes for standard kernels in RHEL 8, RHEL 9, and RHEL 10. Fixes for the RHEL 8 and RHEL 9 real-time kernels remain deferred, while RHEL 6, RHEL 7, and the RHEL 7 real-time kernel are not affected because they lack the vulnerable code. Organizations using affected kernel packages should apply the available updates and plan mitigation for affected real-time deployments until fixes are released.
