CVE-2025-38637 | net_sched: skbprio: Remove overly strict queue assertions

In the Linux kernel, the following vulnerability has been resolved: net_sched: skbprio: Remove overly strict queue assertions In the current implementation, skbprio enqueue/dequeue contains an assertion that fails under certain conditions when SKBPRIO is used as a child qdisc under TBF with specific parameters. The failure occurs because TBF sometimes peeks at packets in the child qdisc without actually dequeuing them when tokens are unavailable. This peek operation creates a discrepancy between the parent and child qdisc queue length counters. When TBF later receives a high-priority packet, SKBPRIO's queue length may show a different value than what's reflected in its internal priority queue tracking, triggering the assertion. The fix removes this overly strict assertions in SKBPRIO, they are not necessary at all.

Published: 2025-04-18 Last update: 2025-11-06 Assigner: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Conclusion & alert: CVE-2025-38637 is rated Low Risk (27/100): CVSS Medium severity, with low exploitation likelihood (EPSS 0.23%). Mandatory action: Monitor for updates and reassess as exploit intelligence or EPSS changes.

Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.

Exploit prediction scoring system (EPSS) score for CVE-2025-38637

EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).

# Date Old EPSS score New EPSS score Delta (New - Old)
1 2026-06-15 0.01% 0.23% +0.22%
2 2026-05-27 0.10% 0.01% -0.08%
3 2026-02-12 0.10%

Full EPSS history (6 records total)

Common vulnerability scoring system (CVSS) metrics for CVE-2025-38637

CVSS metrics for this CVE.

Base score Version Severity Vector Exploitability Impact Score source
5.5 3.1 MEDIUM
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Click to expand
Attack vector (AV:L)
They already need access on the box, or another person has to do something wrong; it’s not a remote drive-by.
Attack complexity (AC:L)
Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup.
Privileges required (PR:L)
A normal user session is enough; they don’t have to be admin.
User interaction (UI:N)
Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:U)
Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems.
Confidentiality (C:N)
Doesn’t really leak secrets in a meaningful way.
Integrity (I:N)
Data isn’t meaningfully altered or forged.
Availability (A:H)
Could take the service down hard or make it unusable for people who depend on it.
1.8 3.6 [email protected]

Weakness enumeration for CVE-2025-38637

OS Trackers for CVE-2025-38637

vendor priority summary link
debian not yet assigned CVE-2025-38637 not yet assigned priority: Debian including 2 source packages (linux, linux-6.1), 6 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 6. https://security-tracker.debian.org/tracker/CVE-2025-38637
redhat medium https://access.redhat.com/security/cve/CVE-2025-38637
suse medium https://www.suse.com/security/cve/CVE-2025-38637/
ubuntu medium CVE-2025-38637 medium priority: Ubuntu including 158 source packages (linux, linux-allwinner-5.19, …), 1550 status rows across 10 suites (bionic, focal, jammy, noble, oracular, plucky, questing, trusty, upstream, xenial): DNE 1144, released 200, ignored 149, not-affected 54, needs-triage 2, needed 1. https://ubuntu.com/security/CVE-2025-38637

Affected software / configurations for CVE-2025-38637

Vendor Product Version Raw CPE
linux linux_kernel >= 4.19, < 5.4.292 cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
linux linux_kernel >= 5.5, < 5.10.236 cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
linux linux_kernel >= 5.11, < 5.15.180 cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
linux linux_kernel >= 5.16, < 6.1.134 cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
linux linux_kernel >= 6.2, < 6.6.87 cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
linux linux_kernel >= 6.7, < 6.12.23 cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
linux linux_kernel >= 6.13, < 6.13.11 cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
linux linux_kernel >= 6.14, < 6.14.2 cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
debian debian_linux 11.0 cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*

References for CVE-2025-38637

URL Tags
https://git.kernel.org/stable/c/034b293bf17c124fec0f0e663f81203b00aa7a50 Patch
https://git.kernel.org/stable/c/1284733bab736e598341f1d3f3b94e2a322864a8 Patch
https://git.kernel.org/stable/c/1dcc144c322a8d526b791135604c0663f1af9d85 Patch
https://git.kernel.org/stable/c/2286770b07cb5268c03d11274b8efd43dff0d380 Patch
https://git.kernel.org/stable/c/2f35b7673a3aa3d09b3eb05811669622ebaa98ca Patch
https://git.kernel.org/stable/c/32ee79682315e6d3c99947b3f38b078a09a66919 Patch
https://git.kernel.org/stable/c/7abc8318ce0712182bf0783dcfdd9a6a8331160e Patch
https://git.kernel.org/stable/c/864ca690ff135078d374bd565b9872f161c614bc Patch
https://git.kernel.org/stable/c/ce8fe975fd99b49c29c42e50f2441ba53112b2e8 Patch
https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html Third Party Advisory
https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html Third Party Advisory
cvelogic Threat Intelligence