CVE-2025-38107
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2025
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
net_sched: ets: fix a race in ets_qdisc_change()
In the Linux kernel, the following vulnerability has been resolved: net_sched: ets: fix a race in ets_qdisc_change() Gerrard Tai reported a race condition in ETS, whenever SFQ perturb timer fires at the wrong time. The race is as follows: CPU 0 CPU 1 [1]: lock root [2]: qdisc_tree_flush_backlog() [3]: unlock root | | [5]: lock root | [6]: rehash | [7]: qdisc_tree_reduce_backlog() | [4]: qdisc_put() This can be abused to underflow a parent's qlen. Calling qdisc_purge_queue() instead of qdisc_tree_flush_backlog() should fix the race, because all packets will be purged from the qdisc before releasing the lock.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
Linux
- Vendor
- Linux
- Product
- Linux
- Platforms
- Unknown
- Default status
unaffected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 699d82e9a6db29d509a71f1f2f4316231e6232e6 | affected | git | eb7b74e9754e1ba2088f914ad1f57a778b11894b | Unavailable | None listed |
| ce881ddbdc028fb1988b66e40e45ca0529c23b46 | affected | git | 0b479d0aa488cb478eb2e1d8868be946ac8afb4f | Unavailable | None listed |
| b05972f01e7d30419987a1f221b5593668fd6448 | affected | git | 347867cb424edae5fec1622712c8dd0a2c42918f | Unavailable | None listed |
| b05972f01e7d30419987a1f221b5593668fd6448 | affected | git | 0383b25488a545be168744336847549d4a2d3d6c | Unavailable | None listed |
| b05972f01e7d30419987a1f221b5593668fd6448 | affected | git | 073f64c03516bcfaf790f8edc772e0cfb8a84ec3 | Unavailable | None listed |
| b05972f01e7d30419987a1f221b5593668fd6448 | affected | git | fed94bd51d62d2e0e006aa61480e94e5cd0582b0 | Unavailable | None listed |
| b05972f01e7d30419987a1f221b5593668fd6448 | affected | git | d92adacdd8c2960be856e0b82acc5b7c5395fddb | Unavailable | None listed |
| fffa19b5e58c34004a0d6f642d9c24b11d213994 | affected | git | Unavailable | Unavailable | None listed |
| fb155f6597cd7bc3aeed668c3bb15fc3b7cb257d | affected | git | Unavailable | Unavailable | None listed |
| 5.10.142 | affected | semver | 5.10.239 | Unavailable | None listed |
| 5.15.66 | affected | semver | 5.15.186 | Unavailable | None listed |
| 5.4.213 | affected | semver | 5.5 | Unavailable | None listed |
| 5.19.8 | affected | semver | 5.20 | Unavailable | None listed |
Linux
- Vendor
- Linux
- Product
- Linux
- Platforms
- Unknown
- Default status
affected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 6.0 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 0 | unaffected | semver | 6.0 | Unavailable | None listed |
| 5.10.239 | unaffected | semver | Unavailable | 5.10.* | None listed |
| 5.15.186 | unaffected | semver | Unavailable | 5.15.* | None listed |
| 6.1.142 | unaffected | semver | Unavailable | 6.1.* | None listed |
| 6.6.94 | unaffected | semver | Unavailable | 6.6.* | None listed |
| 6.12.34 | unaffected | semver | Unavailable | 6.12.* | None listed |
| 6.15.3 | unaffected | semver | Unavailable | 6.15.* | None listed |
| 6.16 | unaffected | original_commit_for_fix | Unavailable | * | None listed |