In the Linux kernel, the following vulnerability has been resolved:
schhfsc: Fix qlen accounting bug when using peek in hfscenqueue()
When enqueuing the first packet to an HFSC class, hfscenqueue() calls the child qdisc's peek() operation before incrementing sch->q.qlen and sch->qstats.backlog. If the child qdisc uses qdiscpeekdequeued(), this may trigger an immediate dequeue and potential packet drop. In such cases, qdisctreereducebacklog() is called, but the HFSC qdisc's qlen and backlog have not yet been updated, leading to inconsistent queue accounting. This can leave an empty HFSC class in the active list, causing further consequences like use-after-free.
This patch fixes the bug by moving the increment of sch->q.qlen and sch->qstats.backlog before the call to the child qdisc's peek() operation. This ensures that queue length and backlog are always accurate when packet drops or dequeues are triggered during the peek.
[
    {
        "signature_version": "v1",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f1dde3eb17dc1b8bd07aed00004b1e05fc87a3d4",
        "digest": {
            "function_hash": "287835363786412421567486350453471152533",
            "length": 860.0
        },
        "target": {
            "function": "hfsc_enqueue",
            "file": "net/sched/sch_hfsc.c"
        },
        "id": "CVE-2025-38000-0d85b13b",
        "deprecated": false,
        "signature_type": "Function"
    },
    {
        "signature_version": "v1",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@89c301e929a0db14ebd94b4d97764ce1d6981653",
        "digest": {
            "function_hash": "287835363786412421567486350453471152533",
            "length": 860.0
        },
        "target": {
            "function": "hfsc_enqueue",
            "file": "net/sched/sch_hfsc.c"
        },
        "id": "CVE-2025-38000-28bdbbd7",
        "deprecated": false,
        "signature_type": "Function"
    },
    {
        "signature_version": "v1",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@89c301e929a0db14ebd94b4d97764ce1d6981653",
        "digest": {
            "line_hashes": [
                "209435903889568462900664786133270691892",
                "315450134644657326341364279311749489083",
                "125971977975267255894703783142680419985",
                "295039215393575406574158557407560863177",
                "183024710459288076497329046882609095359",
                "147074950754970223681912977970379566600",
                "243544154176821408984612633520793089991",
                "245932956511070599315314689174078844663"
            ],
            "threshold": 0.9
        },
        "target": {
            "file": "net/sched/sch_hfsc.c"
        },
        "id": "CVE-2025-38000-3a6a6ad8",
        "deprecated": false,
        "signature_type": "Line"
    },
    {
        "signature_version": "v1",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3f981138109f63232a5fb7165938d4c945cc1b9d",
        "digest": {
            "function_hash": "287835363786412421567486350453471152533",
            "length": 860.0
        },
        "target": {
            "function": "hfsc_enqueue",
            "file": "net/sched/sch_hfsc.c"
        },
        "id": "CVE-2025-38000-3ca1bbcb",
        "deprecated": false,
        "signature_type": "Function"
    },
    {
        "signature_version": "v1",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3f3a22eebbc32b4fa8ce9c1d5f9db214b45b9335",
        "digest": {
            "function_hash": "287835363786412421567486350453471152533",
            "length": 860.0
        },
        "target": {
            "function": "hfsc_enqueue",
            "file": "net/sched/sch_hfsc.c"
        },
        "id": "CVE-2025-38000-46f261d1",
        "deprecated": false,
        "signature_type": "Function"
    },
    {
        "signature_version": "v1",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1034e3310752e8675e313f7271b348914008719a",
        "digest": {
            "function_hash": "287835363786412421567486350453471152533",
            "length": 860.0
        },
        "target": {
            "function": "hfsc_enqueue",
            "file": "net/sched/sch_hfsc.c"
        },
        "id": "CVE-2025-38000-75388034",
        "deprecated": false,
        "signature_type": "Function"
    },
    {
        "signature_version": "v1",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f9f593e34d2fb67644372c8f7b033bdc622ad228",
        "digest": {
            "line_hashes": [
                "209435903889568462900664786133270691892",
                "315450134644657326341364279311749489083",
                "125971977975267255894703783142680419985",
                "295039215393575406574158557407560863177",
                "183024710459288076497329046882609095359",
                "147074950754970223681912977970379566600",
                "243544154176821408984612633520793089991",
                "245932956511070599315314689174078844663"
            ],
            "threshold": 0.9
        },
        "target": {
            "file": "net/sched/sch_hfsc.c"
        },
        "id": "CVE-2025-38000-7ed13239",
        "deprecated": false,
        "signature_type": "Line"
    },
    {
        "signature_version": "v1",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f1dde3eb17dc1b8bd07aed00004b1e05fc87a3d4",
        "digest": {
            "line_hashes": [
                "209435903889568462900664786133270691892",
                "315450134644657326341364279311749489083",
                "125971977975267255894703783142680419985",
                "295039215393575406574158557407560863177",
                "183024710459288076497329046882609095359",
                "147074950754970223681912977970379566600",
                "243544154176821408984612633520793089991",
                "245932956511070599315314689174078844663"
            ],
            "threshold": 0.9
        },
        "target": {
            "file": "net/sched/sch_hfsc.c"
        },
        "id": "CVE-2025-38000-9949360b",
        "deprecated": false,
        "signature_type": "Line"
    },
    {
        "signature_version": "v1",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1034e3310752e8675e313f7271b348914008719a",
        "digest": {
            "line_hashes": [
                "209435903889568462900664786133270691892",
                "315450134644657326341364279311749489083",
                "125971977975267255894703783142680419985",
                "295039215393575406574158557407560863177",
                "183024710459288076497329046882609095359",
                "147074950754970223681912977970379566600",
                "243544154176821408984612633520793089991",
                "245932956511070599315314689174078844663"
            ],
            "threshold": 0.9
        },
        "target": {
            "file": "net/sched/sch_hfsc.c"
        },
        "id": "CVE-2025-38000-b58be74e",
        "deprecated": false,
        "signature_type": "Line"
    },
    {
        "signature_version": "v1",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3f981138109f63232a5fb7165938d4c945cc1b9d",
        "digest": {
            "line_hashes": [
                "209435903889568462900664786133270691892",
                "315450134644657326341364279311749489083",
                "125971977975267255894703783142680419985",
                "295039215393575406574158557407560863177",
                "183024710459288076497329046882609095359",
                "147074950754970223681912977970379566600",
                "243544154176821408984612633520793089991",
                "245932956511070599315314689174078844663"
            ],
            "threshold": 0.9
        },
        "target": {
            "file": "net/sched/sch_hfsc.c"
        },
        "id": "CVE-2025-38000-ccf48710",
        "deprecated": false,
        "signature_type": "Line"
    },
    {
        "signature_version": "v1",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3f3a22eebbc32b4fa8ce9c1d5f9db214b45b9335",
        "digest": {
            "line_hashes": [
                "209435903889568462900664786133270691892",
                "315450134644657326341364279311749489083",
                "125971977975267255894703783142680419985",
                "295039215393575406574158557407560863177",
                "183024710459288076497329046882609095359",
                "147074950754970223681912977970379566600",
                "243544154176821408984612633520793089991",
                "245932956511070599315314689174078844663"
            ],
            "threshold": 0.9
        },
        "target": {
            "file": "net/sched/sch_hfsc.c"
        },
        "id": "CVE-2025-38000-f6049249",
        "deprecated": false,
        "signature_type": "Line"
    },
    {
        "signature_version": "v1",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f9f593e34d2fb67644372c8f7b033bdc622ad228",
        "digest": {
            "function_hash": "287835363786412421567486350453471152533",
            "length": 860.0
        },
        "target": {
            "function": "hfsc_enqueue",
            "file": "net/sched/sch_hfsc.c"
        },
        "id": "CVE-2025-38000-fd5aa625",
        "deprecated": false,
        "signature_type": "Function"
    }
]