A timing-and-lifecycle bug in the Linux traffic‑control scheduler (sch_hfsc) has been assigned CVE‑2025‑38177 after upstream maintainers patched a non‑idempotent qlen_notify pathway that could leave parent qdiscs operating on stale class pointers and, in the worst case, trigger a kernel...