# CVE-2025-38684: net/sched: ets: use old 'nbands' while purging unused classes

> A null pointer dereference in the Linux kernel's ETS scheduler can cause a system crash when purging unused classes.

- **Severity:** Medium 5.5 (`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H`)
- **Exploited in the wild:** Not known
- **Login needed:** Any signed-in user
- **Attackable:** Local or same network only
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 4 Sep 2025
- **Updated:** 23 May 2026
- **Also known as:** BELL-CVE-2025-38684, DEBIAN-CVE-2025-38684, GHSA-fcgw-gqq6-4hgf, ROOT-OS-DEBIAN-11-CVE-2025-38684, ROOT-OS-DEBIAN-12-CVE-2025-38684, ROOT-OS-UBUNTU-2204-CVE-2025-38684, ROOT-OS-UBUNTU-2404-CVE-2025-38684, UBUNTU-CVE-2025-38684

## What is CVE-2025-38684?

CVE-2025-38684 is a medium-severity vulnerability in Debian Debian Linux, published on 4 Sep 2025. It can only be exploited from the same machine or local network, with no action from the victim.

### Official description

In the Linux kernel, the following vulnerability has been resolved:

net/sched: ets: use old 'nbands' while purging unused classes

Shuang reported sch_ets test-case [1] crashing in ets_class_qlen_notify()
after recent changes from Lion [2]. The problem is: in ets_qdisc_change()
we purge unused DWRR queues; the value of 'q->nbands' is the new one, and
the cleanup should be done with the old one. The problem is here since my
first attempts to fix ets_qdisc_change(), but it surfaced again after the
recent qdisc len accounting fixes. Fix it purging idle DWRR queues before
assigning a new value of 'q->nbands', so that all purge operations find a
consistent configuration:

 - old 'q->nbands' because it's needed by ets_class_find()
 - old 'q->nstrict' because it's needed by ets_class_is_strict()

 BUG: kernel NULL pointer dereference, address: 0000000000000000
 #PF: supervisor read access in kernel mode
 #PF: error_code(0x0000) - not-present page
 PGD 0 P4D 0
 Oops: Oops: 0000 [#1] SMP NOPTI
 CPU: 62 UID: 0 PID: 39457 Comm: tc Kdump: loaded Not tainted 6.12.0-116.el10.x86_64 #1 PREEMPT(voluntary)
 Hardware name: Dell Inc. PowerEdge R640/06DKY5, BIOS 2.12.2 07/09/2021
 RIP: 0010:__list_del_entry_valid_or_report+0x4/0x80
 Code: ff 4c 39 c7 0f 84 39 19 8e ff b8 01 00 00 00 c3 cc cc cc cc 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa <48> 8b 17 48 8b 4f 08 48 85 d2 0f 84 56 19 8e ff 48 85 c9 0f 84 ab
 RSP: 0018:ffffba186009f400 EFLAGS: 00010202
 RAX: 00000000000000d6 RBX: 0000000000000000 RCX: 0000000000000004
 RDX: ffff9f0fa29b69c0 RSI: 0000000000000000 RDI: 0000000000000000
 RBP: ffffffffc12c2400 R08: 0000000000000008 R09: 0000000000000004
 R10: ffffffffffffffff R11: 0000000000000004 R12: 0000000000000000
 R13: ffff9f0f8cfe0000 R14: 0000000000100005 R15: 0000000000000000
 FS:  00007f2154f37480(0000) GS:ffff9f269c1c0000(0000) knlGS:0000000000000000
 CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
 CR2: 0000000000000000 CR3: 00000001530be001 CR4: 00000000007726f0
 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
 PKRU: 55555554
 Call Trace:
  <TASK>
  ets_class_qlen_notify+0x65/0x90 [sch_ets]
  qdisc_tree_reduce_backlog+0x74/0x110
  ets_qdisc_change+0x630/0xa40 [sch_ets]
  __tc_modify_qdisc.constprop.0+0x216/0x7f0
  tc_modify_qdisc+0x7c/0x120
  rtnetlink_rcv_msg+0x145/0x3f0
  netlink_rcv_skb+0x53/0x100
  netlink_unicast+0x245/0x390
  netlink_sendmsg+0x21b/0x470
  ____sys_sendmsg+0x39d/0x3d0
  ___sys_sendmsg+0x9a/0xe0
  __sys_sendmsg+0x7a/0xd0
  do_syscall_64+0x7d/0x160
  entry_SYSCALL_64_after_hwframe+0x76/0x7e
 RIP: 0033:0x7f2155114084
 Code: 89 02 b8 ff ff ff ff eb bb 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa 80 3d 25 f0 0c 00 00 74 13 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 54 c3 0f 1f 00 48 83 ec 28 89 54 24 1c 48 89
 RSP: 002b:00007fff1fd7a988 EFLAGS: 00000202 ORIG_RAX: 000000000000002e
 RAX: ffffffffffffffda RBX: 0000560ec063e5e0 RCX: 00007f2155114084
 RDX: 0000000000000000 RSI: 00007fff1fd7a9f0 RDI: 0000000000000003
 RBP: 00007fff1fd7aa60 R08: 0000000000000010 R09: 000000000000003f
 R10: 0000560ee9b3a010 R11: 0000000000000202 R12: 00007fff1fd7aae0
 R13: 000000006891ccde R14: 0000560ec063e5e0 R15: 00007fff1fd7aad0
  </TASK>

 [1] https://lore.kernel.org/netdev/e08c7f4a6882f260011909a868311c6e9b54f3e4.1639153474.git.dcaratti@redhat.com/
 [2] https://lore.kernel.org/netdev/d912cbd7-193b-4269-9857-525bee8bbb6a@gmail.com/

Weakness: CWE-476 (NULL Pointer Dereference)

## Which versions are affected by CVE-2025-38684?

It affects 2 products.


Products: Debian Debian Linux, Linux kernel.

## How do I fix CVE-2025-38684?

Apply the vendor's patch.

## Is CVE-2025-38684 being exploited?

There is no known exploitation of CVE-2025-38684 in the wild and no public exploit code.

## Other vulnerabilities in Debian Debian Linux

- [CVE-2015-3306](https://insights.sbomify.com/CVE-2015-3306/): ProFTPD Improper Access Control (critical 10.0, exploited in the wild)
- [CVE-2025-49113](https://insights.sbomify.com/CVE-2025-49113/): RoundCube Webmail Deserialization of Untrusted Data (critical 9.9, exploited in the wild)
- [CVE-2026-24061](https://insights.sbomify.com/CVE-2026-24061/): GNU InetUtils Argument Injection (critical 9.8, exploited in the wild)
- [CVE-2025-39682](https://insights.sbomify.com/CVE-2025-39682/): Linux Kernel Improper Check for Unusual or Exceptional Conditions (critical 9.8, exploited in the wild)
- [CVE-2024-9680](https://insights.sbomify.com/CVE-2024-9680/): Mozilla Firefox Use-After-Free (critical 9.8, exploited in the wild)

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2025-38684 and fix it if it is affected.

What it is: CVE-2025-38684 is a medium-severity vulnerability in Debian Debian Linux, published on 4 Sep 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Exploitation: There is no known exploitation of CVE-2025-38684 in the wild and no public exploit code.

Affected product: Debian Debian Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2025-38684/ (Markdown: https://insights.sbomify.com/CVE-2025-38684/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2025-38684
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-38684
- OSV: https://osv.dev/vulnerability/CVE-2025-38684

---
From sbomify Insights: https://insights.sbomify.com/CVE-2025-38684/
Summaries are generated and may contain mistakes; the official description above is the record.