In the Linux kernel, the following vulnerability has been resolved:
netsched: red: fix a race in _red_change()
Gerrard Tai reported a race condition in RED, whenever SFQ perturb timer fires at the wrong time.
The race is as follows:
CPU 0 CPU 1 | | [5]: lock root | [6]: rehash | [7]: qdisctreereduce_backlog() | This can be abused to underflow a parent's qlen.
Calling qdiscpurgequeue() instead of qdisctreeflush_backlog() should fix the race, because all packets will be purged from the qdisc before releasing the lock.
[
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@85a3e0ede38450ea3053b8c45d28cf55208409b8",
"digest": {
"threshold": 0.9,
"line_hashes": [
"307492377693060067379901820942145990452",
"180415724337554835957949924524661867540",
"185177157804334123054466106163484420836",
"31063083944858083331145447287242562200"
]
},
"target": {
"file": "net/sched/sch_red.c"
},
"id": "CVE-2025-38108-12ea9488",
"signature_version": "v1",
"signature_type": "Line"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f569984417a4e12c67366e69bdcb752970de921d",
"digest": {
"threshold": 0.9,
"line_hashes": [
"307492377693060067379901820942145990452",
"180415724337554835957949924524661867540",
"185177157804334123054466106163484420836",
"31063083944858083331145447287242562200"
]
},
"target": {
"file": "net/sched/sch_red.c"
},
"id": "CVE-2025-38108-1488ab1c",
"signature_version": "v1",
"signature_type": "Line"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@444ad445df5496a785705019268a8a84b84484bb",
"digest": {
"threshold": 0.9,
"line_hashes": [
"307492377693060067379901820942145990452",
"180415724337554835957949924524661867540",
"185177157804334123054466106163484420836",
"31063083944858083331145447287242562200"
]
},
"target": {
"file": "net/sched/sch_red.c"
},
"id": "CVE-2025-38108-46f65d7d",
"signature_version": "v1",
"signature_type": "Line"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2a71924ca4af59ffc00f0444732b6cd54b153d0e",
"digest": {
"threshold": 0.9,
"line_hashes": [
"307492377693060067379901820942145990452",
"180415724337554835957949924524661867540",
"185177157804334123054466106163484420836",
"31063083944858083331145447287242562200"
]
},
"target": {
"file": "net/sched/sch_red.c"
},
"id": "CVE-2025-38108-65752822",
"signature_version": "v1",
"signature_type": "Line"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2790c4ec481be45a80948d059cd7c9a06bc37493",
"digest": {
"threshold": 0.9,
"line_hashes": [
"88853590619216873383269398414794454650",
"180415724337554835957949924524661867540",
"185177157804334123054466106163484420836",
"31063083944858083331145447287242562200"
]
},
"target": {
"file": "net/sched/sch_red.c"
},
"id": "CVE-2025-38108-65dd4ea5",
"signature_version": "v1",
"signature_type": "Line"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a1bf6a4e9264a685b0e642994031f9c5aad72414",
"digest": {
"threshold": 0.9,
"line_hashes": [
"307492377693060067379901820942145990452",
"180415724337554835957949924524661867540",
"185177157804334123054466106163484420836",
"31063083944858083331145447287242562200"
]
},
"target": {
"file": "net/sched/sch_red.c"
},
"id": "CVE-2025-38108-8d5a91f1",
"signature_version": "v1",
"signature_type": "Line"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4b755305b2b0618e857fdadb499365b5f2e478d1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"307492377693060067379901820942145990452",
"180415724337554835957949924524661867540",
"185177157804334123054466106163484420836",
"31063083944858083331145447287242562200"
]
},
"target": {
"file": "net/sched/sch_red.c"
},
"id": "CVE-2025-38108-9c5727fa",
"signature_version": "v1",
"signature_type": "Line"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@110a47efcf23438ff8d31dbd9c854fae2a48bf98",
"digest": {
"threshold": 0.9,
"line_hashes": [
"307492377693060067379901820942145990452",
"180415724337554835957949924524661867540",
"185177157804334123054466106163484420836",
"31063083944858083331145447287242562200"
]
},
"target": {
"file": "net/sched/sch_red.c"
},
"id": "CVE-2025-38108-a34d0608",
"signature_version": "v1",
"signature_type": "Line"
}
]