Riskcovery

CVE-2025-38107

net_sched: ets: fix a race in ets_qdisc_change()

State
Published
Severity
7.8 High
Published
Jul 3, 2025
Updated
Oct 15, 2026
Reserved
Apr 16, 2025

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

net_sched: ets: fix a race in ets_qdisc_change()

Gerrard Tai reported a race condition in ETS, whenever SFQ perturb timer fires at the wrong time.

The race is as follows:

CPU 0 CPU 1 [1]: lock root [2]: qdisc_tree_flush_backlog() [3]: unlock root | | [5]: lock root | [6]: rehash | [7]: qdisc_tree_reduce_backlog() | [4]: qdisc_put()

This can be abused to underflow a parent's qlen.

Calling qdisc_purge_queue() instead of qdisc_tree_flush_backlog() should fix the race, because all packets will be purged from the qdisc before releasing the lock.

Scores

CVSSScoreVectorSource
3.17.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 699d82e9a6db29d509a71f1f2f4316231e6232e6 to before eb7b74e9754e1ba2088f914ad1f57a778b11894bAffected
  • ce881ddbdc028fb1988b66e40e45ca0529c23b46 to before 0b479d0aa488cb478eb2e1d8868be946ac8afb4fAffected
  • b05972f01e7d30419987a1f221b5593668fd6448 to before 347867cb424edae5fec1622712c8dd0a2c42918fAffected
  • b05972f01e7d30419987a1f221b5593668fd6448 to before 0383b25488a545be168744336847549d4a2d3d6cAffected
  • b05972f01e7d30419987a1f221b5593668fd6448 to before 073f64c03516bcfaf790f8edc772e0cfb8a84ec3Affected
  • b05972f01e7d30419987a1f221b5593668fd6448 to before fed94bd51d62d2e0e006aa61480e94e5cd0582b0Affected
  • b05972f01e7d30419987a1f221b5593668fd6448 to before d92adacdd8c2960be856e0b82acc5b7c5395fddbAffected
  • fffa19b5e58c34004a0d6f642d9c24b11d213994Affected
  • fb155f6597cd7bc3aeed668c3bb15fc3b7cb257dAffected
  • 5.10.142 to before 5.10.239Affected
  • 5.15.66 to before 5.15.186Affected
  • 5.4.213 to before 5.5Affected
  • 5.19.8 to before 5.20Affected
LinuxLinux
  • 6.0Affected
  • before 6.0Not affected
  • 5.10.239 through 5.10.*Not affected
  • 5.15.186 through 5.15.*Not affected
  • 6.1.142 through 6.1.*Not affected
  • 6.6.94 through 6.6.*Not affected
  • 6.12.34 through 6.12.*Not affected
  • 6.15.3 through 6.15.*Not affected
  • 6.16 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.