CVE-2025-38477 — Race Condition in Linux
Severity
4.7MEDIUMNVD
OSV7.8OSV7.1OSV5.5
EPSS
0.0%
top 95.81%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedJul 28
Latest updateFeb 27
Description
In the Linux kernel, the following vulnerability has been resolved:
net/sched: sch_qfq: Fix race condition on qfq_aggregate
A race condition can occur when 'agg' is modified in qfq_change_agg
(called during qfq_enqueue) while other threads access it
concurrently. For example, qfq_dump_class may trigger a NULL
dereference, and qfq_delete_class may cause a use-after-free.
This patch addresses the issue by:
1. Moved qfq_destroy_class into the critical section.
2. Added sch_tree_lock protection…
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 1.0 | Impact: 3.6
Affected Packages4 packages
▶CVEListV5linux/linux462dbc9101acd38e92eda93c0726857517a24bbd — aa7a22c4d678bf649fd3a1d27debec583563414d+8
Also affects: Debian Linux 11.0