CVE-2025-38477

Description

In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_qfq: Fix race condition on qfq_aggregate A race condition can occur when 'agg' is modified in qfq_change_agg (called during qfq_enqueue) while other threads access it concurrently. For example, qfq_dump_class may trigger a NULL dereference, and qfq_delete_class may cause a use-after-free. This patch addresses the issue by: 1. Moved qfq_destroy_class into the critical section. 2. Added sch_tree_lock protection to qfq_dump_class and qfq_dump_class_stats.

Reserved 2025-04-16 | Published 2025-07-28 | Updated 2025-07-28 | Assigner Linux

Product status

Default status
unaffected

462dbc9101acd38e92eda93c0726857517a24bbd before 466e10194ab81caa2ee6a332d33ba16bcceeeba6
affected

462dbc9101acd38e92eda93c0726857517a24bbd before fbe48f06e64134dfeafa89ad23387f66ebca3527
affected

462dbc9101acd38e92eda93c0726857517a24bbd before a6d735100f602c830c16d69fb6d780eebd8c9ae1
affected

462dbc9101acd38e92eda93c0726857517a24bbd before c000a3a330d97f6c073ace5aa5faf94b9adb4b79
affected

462dbc9101acd38e92eda93c0726857517a24bbd before 5e28d5a3f774f118896aec17a3a20a9c5c9dfc64
affected

Default status
affected

3.8
affected

Any version before 3.8
unaffected

6.1.147
unaffected

6.6.100
unaffected

6.12.40
unaffected

6.15.8
unaffected

6.16
unaffected

References

git.kernel.org/...c/466e10194ab81caa2ee6a332d33ba16bcceeeba6

git.kernel.org/...c/fbe48f06e64134dfeafa89ad23387f66ebca3527

git.kernel.org/...c/a6d735100f602c830c16d69fb6d780eebd8c9ae1

git.kernel.org/...c/c000a3a330d97f6c073ace5aa5faf94b9adb4b79

git.kernel.org/...c/5e28d5a3f774f118896aec17a3a20a9c5c9dfc64

cve.org (CVE-2025-38477)

nvd.nist.gov (CVE-2025-38477)

Download JSON