CVE-2025-38278octeontx2-pf: QOS: Refactor TC_HTB_LEAF_DEL_LAST callback
Updated under an hour ago ()
Does this affect you?
It affects Linux and 1 other product. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: QOS: Refactor TC_HTB_LEAF_DEL_LAST callback This patch addresses below issues, 1. Active traffic on the leaf node must be stopped before its send queue is reassigned to the parent. This patch resolves the issue by marking the node as 'Inner'. 2. During a system reboot, the interface receives TC_HTB_LEAF_DEL and TC_HTB_LEAF_DEL_LAST callbacks to delete its HTB queues. In the case of TC_HTB_LEAF_DEL_LAST, although the same send queue is reassigned to the parent, the current logic still attempts to update the real number of queues, leadning to below warnings New queues can't be registered after device unregistration. WARNING: CPU: 0 PID: 6475 at net/core/net-sysfs.c:1714 netdev_queue_update_kobjects+0x1e4/0x200
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Modified
- Record last updated
- Oct 15, 2026
- First seen by InfoSec Signals
- Oct 15, 2026
Affected products
Linux Linux linux:linux (from the name) | 5e6808b4c68d7882971514ab3279926eb07c8b2d builds before 5df8db01d6a4e9c35a5ba5d7e130d5cecd3ffcb4; from 5e6808b4c68d7882971514ab3279926eb07c8b2d before ec62c99914a79d84c8de5ba1b94d62f2ed721f2a; from 5e6808b4c68d7882971514ab3279926eb07c8b2d before f1fca0eae5a0573f226f46c6871260278e7dda12; from 5e6808b4c68d7882971514ab3279926eb07c8b2d before 67af4ec948e8ce3ea53a9cf614d01fddf172e56d | CNA record |
linux linux_kernel linux:linux_kernel | from 6.5 before 6.6.94; from 6.7 before 6.12.34; from 6.13 before 6.15.3 | NVD |
References
- https://git.kernel.org/stable/c/5df8db01d6a4e9c35a5ba5d7e130d5cecd3ffcb4patch
- https://git.kernel.org/stable/c/ec62c99914a79d84c8de5ba1b94d62f2ed721f2apatch
- https://git.kernel.org/stable/c/f1fca0eae5a0573f226f46c6871260278e7dda12patch
- https://git.kernel.org/stable/c/67af4ec948e8ce3ea53a9cf614d01fddf172e56dpatch
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.