CVE-2025-38108
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2025
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
net_sched: red: fix a race in __red_change()
In the Linux kernel, the following vulnerability has been resolved: net_sched: red: fix a race in __red_change() Gerrard Tai reported a race condition in RED, whenever SFQ perturb timer fires at the wrong time. The race is as follows: CPU 0 CPU 1 [1]: lock root [2]: qdisc_tree_flush_backlog() [3]: unlock root | | [5]: lock root | [6]: rehash | [7]: qdisc_tree_reduce_backlog() | [4]: qdisc_put() This can be abused to underflow a parent's qlen. Calling qdisc_purge_queue() instead of qdisc_tree_flush_backlog() should fix the race, because all packets will be purged from the qdisc before releasing the lock.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
Linux
- Vendor
- Linux
- Product
- Linux
- Platforms
- Unknown
- Default status
unaffected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 0c8d13ac96070000da33f394f45e9c19638483c5 | affected | git | 2790c4ec481be45a80948d059cd7c9a06bc37493 | Unavailable | None listed |
| 0c8d13ac96070000da33f394f45e9c19638483c5 | affected | git | a1bf6a4e9264a685b0e642994031f9c5aad72414 | Unavailable | None listed |
| 0c8d13ac96070000da33f394f45e9c19638483c5 | affected | git | 110a47efcf23438ff8d31dbd9c854fae2a48bf98 | Unavailable | None listed |
| 0c8d13ac96070000da33f394f45e9c19638483c5 | affected | git | f569984417a4e12c67366e69bdcb752970de921d | Unavailable | None listed |
| 0c8d13ac96070000da33f394f45e9c19638483c5 | affected | git | 2a71924ca4af59ffc00f0444732b6cd54b153d0e | Unavailable | None listed |
| 0c8d13ac96070000da33f394f45e9c19638483c5 | affected | git | 4b755305b2b0618e857fdadb499365b5f2e478d1 | Unavailable | None listed |
| 0c8d13ac96070000da33f394f45e9c19638483c5 | affected | git | 444ad445df5496a785705019268a8a84b84484bb | Unavailable | None listed |
| 0c8d13ac96070000da33f394f45e9c19638483c5 | affected | git | 85a3e0ede38450ea3053b8c45d28cf55208409b8 | Unavailable | None listed |
Linux
- Vendor
- Linux
- Product
- Linux
- Platforms
- Unknown
- Default status
affected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 5.0 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 0 | unaffected | semver | 5.0 | Unavailable | None listed |
| 5.4.295 | unaffected | semver | Unavailable | 5.4.* | None listed |
| 5.10.239 | unaffected | semver | Unavailable | 5.10.* | None listed |
| 5.15.186 | unaffected | semver | Unavailable | 5.15.* | None listed |
| 6.1.142 | unaffected | semver | Unavailable | 6.1.* | None listed |
| 6.6.94 | unaffected | semver | Unavailable | 6.6.* | None listed |
| 6.12.34 | unaffected | semver | Unavailable | 6.12.* | None listed |
| 6.15.3 | unaffected | semver | Unavailable | 6.15.* | None listed |
| 6.16 | unaffected | original_commit_for_fix | Unavailable | * | None listed |