CVE-2025-38107

Katalog CVE

CVSS 7.0 · High EPSS 0,15%

Kerentanan Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') pada linux kernel, debian linux. Skor CVSS 3.1 7.0 (High) menurut NVD.

Deskripsi (NVD)

In the Linux kernel, the following vulnerability has been resolved: net_sched: ets: fix a race in ets_qdisc_change() Gerrard Tai reported a race condition in ETS, whenever SFQ perturb timer fires at the wrong time. The race is as follows: CPU 0 CPU 1 [1]: lock root [2]: qdisc_tree_flush_backlog() [3]: unlock root | | [5]: lock root | [6]: rehash | [7]: qdisc_tree_reduce_backlog() | [4]: qdisc_put() This can be abused to underflow a parent's qlen. Calling qdisc_purge_queue() instead of qdisc_tree_flush_backlog() should fix the race, because all packets will be purged from the qdisc before releasing the lock.

Rincian

Terbit di NVD

3 Juli 2025

Terakhir diubah

30 Juli 2026

Status NVD

Modified

CVSS 3.1

7.0 (High), sumber NVD
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

EPSS (30 hari)

0,15% peluang dieksploitasi; lebih tinggi dari 3,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://git.kernel.org/stable/c/0383b25488a545be168744336847549d4a2d3d6c patch
• https://git.kernel.org/stable/c/073f64c03516bcfaf790f8edc772e0cfb8a84ec3 patch
• https://git.kernel.org/stable/c/0b479d0aa488cb478eb2e1d8868be946ac8afb4f patch
• https://git.kernel.org/stable/c/347867cb424edae5fec1622712c8dd0a2c42918f patch
• https://git.kernel.org/stable/c/d92adacdd8c2960be856e0b82acc5b7c5395fddb patch
• https://git.kernel.org/stable/c/eb7b74e9754e1ba2088f914ad1f57a778b11894b patch
• https://git.kernel.org/stable/c/fed94bd51d62d2e0e006aa61480e94e5cd0582b0 patch
• https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html mailing list · advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html mailing list · advisory pihak ketiga