CVE-2025-38477

Advisory lineage Upstream: 0 Downstream: 163
Modified
Published: 28 Jul 2025, 11:21
Last modified:12 May 2026, 12:05

Vulnerability Summary

Overall Risk (default)
low
19/100
CVSS Score
4.7 MEDIUM
v3.1 (nvd)
EPSS Score
0.05% LOW
0% probability +0.03%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

28 Jul 2025, 11:21
Published
Vulnerability first disclosed
12 May 2026, 12:05
Last Modified
Vulnerability information updated

Description

In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_qfq: Fix race condition on qfq_aggregate A race condition can occur when 'agg' is modified in qfq_change_agg (called during qfq_enqueue) while other threads access it concurrently. For example, qfq_dump_class may trigger a NULL dereference, and qfq_delete_class may cause a use-after-free. This patch addresses the issue by: 1. Moved qfq_destroy_class into the critical section. 2. Added sch_tree_lock protection to qfq_dump_class and qfq_dump_class_stats.

CVSS Metrics

  • v3.1•MEDIUM•Score: 4.7CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS Trends

Current EPSS score: 0.05%• Percentile: 16%

Techniques & Countermeasures

  • CWE-362•Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

    The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

Affected Systems

  • debian•debian_linux

    11.0

  • linux•linux

    ≥ 462dbc9101acd38e92eda93c0726857517a24bbd, < aa7a22c4d678bf649fd3a1d27debec583563414d | ≥ 462dbc9101acd38e92eda93c0726857517a24bbd, < d841aa5518508ab195b6781ad0d73ee378d713dd | ≥ 462dbc9101acd38e92eda93c0726857517a24bbd, < c6df794000147a3a02f79984aada4ce83f8d0a1e | ≥ 462dbc9101acd38e92eda93c0726857517a24bbd, < 466e10194ab81caa2ee6a332d33ba16bcceeeba6 | ≥ 462dbc9101acd38e92eda93c0726857517a24bbd, < fbe48f06e64134dfeafa89ad23387f66ebca3527 | ≥ 462dbc9101acd38e92eda93c0726857517a24bbd, < a6d735100f602c830c16d69fb6d780eebd8c9ae1 | ≥ 462dbc9101acd38e92eda93c0726857517a24bbd, < c000a3a330d97f6c073ace5aa5faf94b9adb4b79 | ≥ 462dbc9101acd38e92eda93c0726857517a24bbd, < 5e28d5a3f774f118896aec17a3a20a9c5c9dfc64 | 3.8

  • linux•linux_kernel

    ≥ 3.8, < 5.4.297 | ≥ 5.5, < 5.10.241 | ≥ 5.11, < 5.15.190 | ≥ 5.16, < 6.1.147 | ≥ 6.2, < 6.6.100 | ≥ 6.7, < 6.12.40 | ≥ 6.13, < 6.15.8 | 6.16:rc1 | 6.16:rc2 | 6.16:rc3 | 6.16:rc4 | 6.16:rc5 | 6.16:rc6

References (11)