4.7

CVE-2025-38477

net/sched: sch_qfq: Fix race condition on qfq_aggregate

In the Linux kernel, the following vulnerability has been resolved:

net/sched: sch_qfq: Fix race condition on qfq_aggregate

A race condition can occur when 'agg' is modified in qfq_change_agg
(called during qfq_enqueue) while other threads access it
concurrently. For example, qfq_dump_class may trigger a NULL
dereference, and qfq_delete_class may cause a use-after-free.

This patch addresses the issue by:

1. Moved qfq_destroy_class into the critical section.

2. Added sch_tree_lock protection to qfq_dump_class and
qfq_dump_class_stats.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Linux ≫ Linux Kernel Version >= 3.8 < 5.4.297
Linux ≫ Linux Kernel Version >= 5.5 < 5.10.241
Linux ≫ Linux Kernel Version >= 5.11 < 5.15.190
Linux ≫ Linux Kernel Version >= 5.16 < 6.1.147
Linux ≫ Linux Kernel Version >= 6.2 < 6.6.100
Linux ≫ Linux Kernel Version >= 6.7 < 6.12.40
Linux ≫ Linux Kernel Version >= 6.13 < 6.15.8
Linux ≫ Linux Kernel Version 6.16 Update rc1
Linux ≫ Linux Kernel Version 6.16 Update rc2
Linux ≫ Linux Kernel Version 6.16 Update rc3
Linux ≫ Linux Kernel Version 6.16 Update rc4
Linux ≫ Linux Kernel Version 6.16 Update rc5
Linux ≫ Linux Kernel Version 6.16 Update rc6
Debian ≫ Debian Linux Version 11.0
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.13% 0.029
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 4.7 1 3.6
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
416baaa9-dc9f-4396-8d5f-8c081fb06d67 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

https://git.kernel.org/stable/c/466e10194ab81caa2ee6a332d33ba16bcceeeba6
Patch
https://git.kernel.org/stable/c/fbe48f06e64134dfeafa89ad23387f66ebca3527
Patch
https://git.kernel.org/stable/c/a6d735100f602c830c16d69fb6d780eebd8c9ae1
Patch
https://git.kernel.org/stable/c/c000a3a330d97f6c073ace5aa5faf94b9adb4b79
Patch
https://git.kernel.org/stable/c/5e28d5a3f774f118896aec17a3a20a9c5c9dfc64
Patch
https://git.kernel.org/stable/c/aa7a22c4d678bf649fd3a1d27debec583563414d
Patch
https://git.kernel.org/stable/c/c6df794000147a3a02f79984aada4ce83f8d0a1e
Patch
https://git.kernel.org/stable/c/d841aa5518508ab195b6781ad0d73ee378d713dd
Patch
https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html
Third Party Advisory
Mailing List
https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html
Third Party Advisory
Mailing List
https://cert-portal.siemens.com/productcert/html/ssa-082556.html