In the Linux kernel, the following vulnerability has been resolved:
netsched: ets: fix a race in etsqdisc_change()
Gerrard Tai reported a race condition in ETS, whenever SFQ perturb timer fires at the wrong time.
The race is as follows:
CPU 0 CPU 1 | | [5]: lock root | [6]: rehash | [7]: qdisctreereduce_backlog() | This can be abused to underflow a parent's qlen.
Calling qdiscpurgequeue() instead of qdisctreeflush_backlog() should fix the race, because all packets will be purged from the qdisc before releasing the lock.
[
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@347867cb424edae5fec1622712c8dd0a2c42918f",
"deprecated": false,
"id": "CVE-2025-38107-53a9babe",
"target": {
"file": "net/sched/sch_ets.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"177439367240147608756047695441783098044",
"21133024085228372231144146741641063815",
"308336017543997657160035398632993989631",
"3592481722360821785911931212595178196"
]
},
"signature_type": "Line"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0383b25488a545be168744336847549d4a2d3d6c",
"deprecated": false,
"id": "CVE-2025-38107-86605ed7",
"target": {
"file": "net/sched/sch_ets.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"177439367240147608756047695441783098044",
"21133024085228372231144146741641063815",
"308336017543997657160035398632993989631",
"3592481722360821785911931212595178196"
]
},
"signature_type": "Line"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@eb7b74e9754e1ba2088f914ad1f57a778b11894b",
"deprecated": false,
"id": "CVE-2025-38107-b047f535",
"target": {
"file": "net/sched/sch_ets.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"177439367240147608756047695441783098044",
"21133024085228372231144146741641063815",
"308336017543997657160035398632993989631",
"3592481722360821785911931212595178196"
]
},
"signature_type": "Line"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d92adacdd8c2960be856e0b82acc5b7c5395fddb",
"deprecated": false,
"id": "CVE-2025-38107-c2d7957e",
"target": {
"file": "net/sched/sch_ets.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"177439367240147608756047695441783098044",
"21133024085228372231144146741641063815",
"278114242360465331697478024207110668072",
"61750991076281437260170059644886865225"
]
},
"signature_type": "Line"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0b479d0aa488cb478eb2e1d8868be946ac8afb4f",
"deprecated": false,
"id": "CVE-2025-38107-ddd30d78",
"target": {
"file": "net/sched/sch_ets.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"177439367240147608756047695441783098044",
"21133024085228372231144146741641063815",
"308336017543997657160035398632993989631",
"3592481722360821785911931212595178196"
]
},
"signature_type": "Line"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fed94bd51d62d2e0e006aa61480e94e5cd0582b0",
"deprecated": false,
"id": "CVE-2025-38107-ffc0da9f",
"target": {
"file": "net/sched/sch_ets.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"177439367240147608756047695441783098044",
"21133024085228372231144146741641063815",
"278114242360465331697478024207110668072",
"61750991076281437260170059644886865225"
]
},
"signature_type": "Line"
}
]