CVE-2025-38107: net_sched: ets: fix a race in ets_qdisc_change()
In the Linux kernel, the following vulnerability has been resolved:
netsched: ets: fix a race in etsqdiscchange()
Gerrard Tai reported a race condition in ETS, whenever SFQ perturb timer fires at the wrong time.
The race is as follows:
CPU 0 CPU 1 [1]: lock root [2]: qdisctreeflushbacklog() [3]: unlock root | | [5]: lock root | [6]: rehash | [7]: qdisctreereducebacklog() | [4]: qdiscput()
This can be abused to underflow a parent's qlen.
Calling qdiscpurgequeue() instead of qdisctreeflushbacklog() should fix the race, because all packets will be purged from the qdisc before releasing the lock.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch net_sched: ets: fix a race in ets_qdisc_change()
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38107?
CVE-2025-38107 is categorized as a medium severity vulnerability due to its race condition in the Linux kernel.
How do I fix CVE-2025-38107?
To fix CVE-2025-38107, update your Linux kernel to the latest version where this vulnerability has been patched.
What software is affected by CVE-2025-38107?
CVE-2025-38107 affects the Linux kernel, particularly related to the ETS scheduling.
What type of vulnerability is CVE-2025-38107?
CVE-2025-38107 is a race condition vulnerability that can occur in the Linux kernel's network scheduling.
Who reported the CVE-2025-38107 vulnerability?
CVE-2025-38107 was reported by security researcher Gerrard Tai.