Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

CVE-2025-38107— net_sched: ets: fix a race in ets_qdisc_change()

EPSS 0.06% · P20

Affected Version Matrix 18

VendorProductVersion RangeStatus
LinuxLinux699d82e9a6db29d509a71f1f2f4316231e6232e6< eb7b74e9754e1ba2088f914ad1f57a778b11894baffected
ce881ddbdc028fb1988b66e40e45ca0529c23b46< 0b479d0aa488cb478eb2e1d8868be946ac8afb4faffected
b05972f01e7d30419987a1f221b5593668fd6448< 347867cb424edae5fec1622712c8dd0a2c42918faffected
b05972f01e7d30419987a1f221b5593668fd6448< 0383b25488a545be168744336847549d4a2d3d6caffected
b05972f01e7d30419987a1f221b5593668fd6448< 073f64c03516bcfaf790f8edc772e0cfb8a84ec3affected
b05972f01e7d30419987a1f221b5593668fd6448< fed94bd51d62d2e0e006aa61480e94e5cd0582b0affected
b05972f01e7d30419987a1f221b5593668fd6448< d92adacdd8c2960be856e0b82acc5b7c5395fddbaffected
fffa19b5e58c34004a0d6f642d9c24b11d213994affected
… +10 more rows
Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2025-38107

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
net_sched: ets: fix a race in ets_qdisc_change()
Source: NVD (National Vulnerability Database)
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: net_sched: ets: fix a race in ets_qdisc_change() Gerrard Tai reported a race condition in ETS, whenever SFQ perturb timer fires at the wrong time. The race is as follows: CPU 0 CPU 1 [1]: lock root [2]: qdisc_tree_flush_backlog() [3]: unlock root | | [5]: lock root | [6]: rehash | [7]: qdisc_tree_reduce_backlog() | [4]: qdisc_put() This can be abused to underflow a parent's qlen. Calling qdisc_purge_queue() instead of qdisc_tree_flush_backlog() should fix the race, because all packets will be purged from the qdisc before releasing the lock.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于net_sched ets在ets_qdisc_change中竞争条件。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

VendorProductAffected VersionsCPESubscribe
LinuxLinux 699d82e9a6db29d509a71f1f2f4316231e6232e6 ~ eb7b74e9754e1ba2088f914ad1f57a778b11894b -
LinuxLinux 6.0 -

II. Public POCs for CVE-2025-38107

#POC DescriptionSource LinkShenlong Link
AI-Generated POCPremium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2025-38107

请登录查看更多情报信息。

Same Patch Batch · Linux · 2025-07-03 · 78 CVEs total

CVE-2025-38129page_pool: Fix use-after-free in page_pool_recycle_in_ring
CVE-2025-38128Bluetooth: MGMT: reject malformed HCI_CMD_SYNC commands
CVE-2025-38114e1000: Move cancel_work_sync to avoid deadlock
CVE-2025-38127ice: fix Tx scheduler error handling in XDP callback
CVE-2025-38125net: stmmac: make sure that ptp_rate is not 0 before configuring EST
CVE-2025-38126net: stmmac: make sure that ptp_rate is not 0 before configuring timestamping
CVE-2025-38130drm/connector: only call HDMI audio helper plugged cb if non-null
CVE-2025-38131coresight: prevent deactivate active config while enabling the config
CVE-2025-38132coresight: holding cscfg_csdev_lock while removing cscfg from csdev
CVE-2025-38133iio: adc: ad4851: fix ad4858 chan pointer handling
CVE-2025-38124net: fix udp gso skb_segment after pull from frag_list
CVE-2025-38122gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO
CVE-2025-38123net: wwan: t7xx: Fix napi rx poll issue
CVE-2025-38121wifi: iwlwifi: mld: avoid panic on init failure
CVE-2025-38119scsi: core: ufs: Fix a hang in the error handler
CVE-2025-38120netfilter: nf_set_pipapo_avx2: fix initial map fill
CVE-2025-38118Bluetooth: MGMT: Fix UAF on mgmt_remove_adv_monitor_complete
CVE-2025-38117Bluetooth: MGMT: Protect mgmt_pending list with its own lock
CVE-2025-38115net_sched: sch_sfq: fix a potential crash on gso_skb handling
CVE-2025-38116wifi: ath12k: fix uaf in ath12k_core_init()

Showing top 20 of 78 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2025-38107

No comments yet

Leave a comment