CVE-2025-38083

Description

In the Linux kernel, the following vulnerability has been resolved: net_sched: prio: fix a race in prio_tune() Gerrard Tai reported a race condition in PRIO, whenever SFQ perturb timer fires at the wrong time. The race is as follows: CPU 0 CPU 1 [1]: lock root [2]: qdisc_tree_flush_backlog() [3]: unlock root | | [5]: lock root | [6]: rehash | [7]: qdisc_tree_reduce_backlog() | [4]: qdisc_put() This can be abused to underflow a parent's qlen. Calling qdisc_purge_queue() instead of qdisc_tree_flush_backlog() should fix the race, because all packets will be purged from the qdisc before releasing the lock.

Reserved 2025-04-16 | Published 2025-06-20 | Updated 2025-06-20 | Assigner Linux

Product status

Default status
unaffected

7b8e0b6e659983154c8d7e756cdb833d89a3d4d7 before 46c15c9d0f65c9ba857d63f53264f4b17e8a715f
affected

7b8e0b6e659983154c8d7e756cdb833d89a3d4d7 before e3f6745006dc9423d2b065b90f191cfa11b1b584
affected

7b8e0b6e659983154c8d7e756cdb833d89a3d4d7 before 93f9eeb678d4c9c1abf720b3615fa8299a490845
affected

7b8e0b6e659983154c8d7e756cdb833d89a3d4d7 before d35acc1be3480505b5931f17e4ea9b7617fea4d3
affected

Default status
affected

5.0
affected

Any version before 5.0
unaffected

6.6.94
unaffected

6.12.34
unaffected

6.15.3
unaffected

6.16-rc2
unaffected

References

git.kernel.org/...c/46c15c9d0f65c9ba857d63f53264f4b17e8a715f

git.kernel.org/...c/e3f6745006dc9423d2b065b90f191cfa11b1b584

git.kernel.org/...c/93f9eeb678d4c9c1abf720b3615fa8299a490845

git.kernel.org/...c/d35acc1be3480505b5931f17e4ea9b7617fea4d3

cve.org (CVE-2025-38083)

nvd.nist.gov (CVE-2025-38083)

Download JSON