CVE-2025-38108net_sched: red: fix a race in __red_change()
Updated under an hour ago ()
Does this affect you?
It affects Linux and 2 other products. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: net_sched: red: fix a race in __red_change() Gerrard Tai reported a race condition in RED, whenever SFQ perturb timer fires at the wrong time. The race is as follows: CPU 0 CPU 1 [1]: lock root [2]: qdisc_tree_flush_backlog() [3]: unlock root | | [5]: lock root | [6]: rehash | [7]: qdisc_tree_reduce_backlog() | [4]: qdisc_put() This can be abused to underflow a parent's qlen. Calling qdisc_purge_queue() instead of qdisc_tree_flush_backlog() should fix the race, because all packets will be purged from the qdisc before releasing the lock.
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Modified
- Record last updated
- Oct 15, 2026
- First seen by InfoSec Signals
- Oct 15, 2026
Affected products
Linux Linux linux:linux (from the name) | from 0c8d13ac96070000da33f394f45e9c19638483c5 before 2790c4ec481be45a80948d059cd7c9a06bc37493; from 0c8d13ac96070000da33f394f45e9c19638483c5 before a1bf6a4e9264a685b0e642994031f9c5aad72414; from 0c8d13ac96070000da33f394f45e9c19638483c5 before 110a47efcf23438ff8d31dbd9c854fae2a48bf98; from 0c8d13ac96070000da33f394f45e9c19638483c5 before f569984417a4e12c67366e69bdcb752970de921d; from 0c8d13ac96070000da33f394f45e9c19638483c5 before 2a71924ca4af59ffc00f0444732b6cd54b153d0e; from 0c8d13ac96070000da33f394f45e9c19638483c5 before 4b755305b2b0618e857fdadb499365b5f2e478d1; from 0c8d13ac96070000da33f394f45e9c19638483c5 before 444ad445df5496a785705019268a8a84b84484bb; from 0c8d13ac96070000da33f394f45e9c19638483c5 before 85a3e0ede38450ea3053b8c45d28cf55208409b8 | CNA record |
linux linux_kernel linux:linux_kernel | from 5.0 before 5.4.295; from 5.5 before 5.10.239; from 5.11 before 5.15.186; from 5.16 before 6.1.142; from 6.2 before 6.6.94; from 6.7 before 6.12.34; from 6.13 before 6.15.3; 6.16 | NVD |
debian debian_linux debian:debian_linux | 11.0 | NVD |
References
- https://git.kernel.org/stable/c/2790c4ec481be45a80948d059cd7c9a06bc37493patch
- https://git.kernel.org/stable/c/a1bf6a4e9264a685b0e642994031f9c5aad72414patch
- https://git.kernel.org/stable/c/110a47efcf23438ff8d31dbd9c854fae2a48bf98patch
- https://git.kernel.org/stable/c/f569984417a4e12c67366e69bdcb752970de921dpatch
- https://git.kernel.org/stable/c/2a71924ca4af59ffc00f0444732b6cd54b153d0epatch
- https://git.kernel.org/stable/c/4b755305b2b0618e857fdadb499365b5f2e478d1patch
- https://git.kernel.org/stable/c/444ad445df5496a785705019268a8a84b84484bbpatch
- https://git.kernel.org/stable/c/85a3e0ede38450ea3053b8c45d28cf55208409b8patch
- https://lists.debian.org/debian-lts-announce/2025/10/msg00007.htmlmailing-list, third-party-advisory
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.htmlmailing-list, third-party-advisory
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.