7.8 High

CVE-2025-38477 In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_qfq: Fix race condition on…

Description

In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_qfq: Fix race condition on qfq_aggregate A race condition can occur when 'agg' is modified in qfq_change_agg (called during qfq_enqueue) while other threads access it concurrently. For example, qfq_dump_class may trigger a NULL dereference, and qfq_delete_class may cause a use-after-free. This patch addresses the issue by: 1. Moved qfq_destroy_class into the critical section. 2. Added sch_tree_lock protection to qfq_dump_class and qfq_dump_class_stats.

Affected products and versions

Product	Affected versions	Fixed in
Linux 6.16	earliest → < 6.16	6.16
Linux 6.15	earliest → < 6.15.8	6.15.8
Linux 6.12	earliest → < 6.12.40	6.12.40
Linux 6.6	earliest → < 6.6.100	6.6.100
Linux 6.1	earliest → < 6.1.147	6.1.147
Linux 5.15	earliest → < 5.15.190	5.15.190
Linux 5.10	earliest → < 5.10.241	5.10.241
Linux 5.4	earliest → < 5.4.297	5.4.297
Linux	3.8	No fix stated

Show the 3 other branches

Product	Affected versions	Fixed in
SIMATIC S7-1500 CPU 1518-4 PN/DP MFP 3.1	3.1.5 → latest	No fix stated
SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP 3.1	3.1.5 → latest	No fix stated
SIPLUS S7-1500 CPU 1518-4 PN/DP MFP 3.1	3.1.5 → latest	No fix stated