NetSight
IP …
high7.8

CVE-2025-38107

In the Linux kernel, the following vulnerability has been resolved: net_sched: ets: fix a race in ets_qdisc_change() Gerrard Tai reported a race condition in E…

Impact

In the Linux kernel, the following vulnerability has been resolved: net_sched: ets: fix a race in ets_qdisc_change() Gerrard Tai reported a race condition in ETS, whenever SFQ perturb timer fires at the wrong time. The race is as follows: CPU 0 CPU 1 [1]: lock root [2]: qdisc_tree_flush_backlog() [3]: unlock root | | [5]: lock root | [6]: rehash | [7]: qdisc_tree_reduce_backlog() | [4]: qdisc_put() This can be abused to underflow a parent's qlen. Calling qdisc_purge_queue() instead of qdisc_tree_flush_backlog() should fix the race, because all packets will be purged from the qdisc before releasing the lock.

Affected products

VendorProductAffected versions
LinuxLinux Kernel
from 5.4.213 before 5.5
from 5.10.142 before 5.10.239
from 5.15.66 before 5.15.186
from 5.19.8 before 6.0
from 6.0.1 before 6.1.142
from 6.2 before 6.6.94
DebianDebian Linux
Version 11.0

Weakness classification

CWE-362

References