CVE-2025-38107net_sched: ets: fix a race in ets_qdisc_change()
Updated under an hour ago ()
Does this affect you?
It affects Linux and 2 other products. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: net_sched: ets: fix a race in ets_qdisc_change() Gerrard Tai reported a race condition in ETS, whenever SFQ perturb timer fires at the wrong time. The race is as follows: CPU 0 CPU 1 [1]: lock root [2]: qdisc_tree_flush_backlog() [3]: unlock root | | [5]: lock root | [6]: rehash | [7]: qdisc_tree_reduce_backlog() | [4]: qdisc_put() This can be abused to underflow a parent's qlen. Calling qdisc_purge_queue() instead of qdisc_tree_flush_backlog() should fix the race, because all packets will be purged from the qdisc before releasing the lock.
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Modified
- Record last updated
- Oct 15, 2026
- First seen by InfoSec Signals
- Oct 15, 2026
Affected products
Linux Linux linux:linux (from the name) | from 699d82e9a6db29d509a71f1f2f4316231e6232e6 before eb7b74e9754e1ba2088f914ad1f57a778b11894b; from ce881ddbdc028fb1988b66e40e45ca0529c23b46 before 0b479d0aa488cb478eb2e1d8868be946ac8afb4f; from b05972f01e7d30419987a1f221b5593668fd6448 before 347867cb424edae5fec1622712c8dd0a2c42918f; from b05972f01e7d30419987a1f221b5593668fd6448 before 0383b25488a545be168744336847549d4a2d3d6c; from b05972f01e7d30419987a1f221b5593668fd6448 before 073f64c03516bcfaf790f8edc772e0cfb8a84ec3; from b05972f01e7d30419987a1f221b5593668fd6448 before fed94bd51d62d2e0e006aa61480e94e5cd0582b0; from b05972f01e7d30419987a1f221b5593668fd6448 before d92adacdd8c2960be856e0b82acc5b7c5395fddb; fffa19b5e58c34004a0d6f642d9c24b11d213994; and 5 more ranges | CNA record |
linux linux_kernel linux:linux_kernel | from 5.4.213 before 5.5; from 5.10.142 before 5.10.239; from 5.15.66 before 5.15.186; from 5.19.8 before 6.0; from 6.0.1 before 6.1.142; from 6.2 before 6.6.94; from 6.7 before 6.12.34; from 6.13 before 6.15.3; and 6 more ranges | NVD |
debian debian_linux debian:debian_linux | 11.0 | NVD |
References
- https://git.kernel.org/stable/c/eb7b74e9754e1ba2088f914ad1f57a778b11894bpatch
- https://git.kernel.org/stable/c/0b479d0aa488cb478eb2e1d8868be946ac8afb4fpatch
- https://git.kernel.org/stable/c/347867cb424edae5fec1622712c8dd0a2c42918fpatch
- https://git.kernel.org/stable/c/0383b25488a545be168744336847549d4a2d3d6cpatch
- https://git.kernel.org/stable/c/073f64c03516bcfaf790f8edc772e0cfb8a84ec3patch
- https://git.kernel.org/stable/c/fed94bd51d62d2e0e006aa61480e94e5cd0582b0patch
- https://git.kernel.org/stable/c/d92adacdd8c2960be856e0b82acc5b7c5395fddbpatch
- https://lists.debian.org/debian-lts-announce/2025/10/msg00007.htmlmailing-list, third-party-advisory
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.htmlmailing-list, third-party-advisory
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.