FlawAtlas
Search the atlas
CVE-2025-38477 Not scored

net/sched: sch_qfq: Fix race condition on qfq_aggregate

In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_qfq: Fix race condition on qfq_aggregate A race condition can occur when 'agg' is modified in qfq_change_agg (called during qfq_enqueue) while other threads access it concurrently. For example, qfq_dump_class may trigger a NULL dereference, and qfq_delete_class may cause a use-after-free. This patch addresses the issue by: 1. Moved qfq_destroy_class into the critical section. 2. Added sch_tree_lock protection to qfq_dump_class and qfq_dump_class_stats.

Exploit probability 0.1%
Published July 28, 2025
Required by Not available
Last source change July 15, 2026

02 / AFFECTED SOFTWARE

Affected packages

Linux Kernel
Unknown Unknown

03 / CONNECTIONS

Connected vulnerabilities

related ALSA-2025:15008
related OPENSUSE-SU-2025:20081-1
related SUSE-SU-2025:02846-1
related SUSE-SU-2025:02849-1
related SUSE-SU-2025:02851-1
related SUSE-SU-2025:02852-1
related SUSE-SU-2025:02853-1
related SUSE-SU-2025:02923-1
related SUSE-SU-2025:02969-1
related SUSE-SU-2025:02996-1
related SUSE-SU-2025:02997-1
related SUSE-SU-2025:03011-1
related SUSE-SU-2025:03023-1
related SUSE-SU-2025:03310-1
related SUSE-SU-2025:03344-1
related SUSE-SU-2025:03384-1
related SUSE-SU-2025:03465-1
related SUSE-SU-2025:03468-1
related SUSE-SU-2025:03469-1
related SUSE-SU-2025:03470-1
related SUSE-SU-2025:03472-1
related SUSE-SU-2025:03473-1
related SUSE-SU-2025:03475-1
related SUSE-SU-2025:03476-1
related SUSE-SU-2025:03479-1
related SUSE-SU-2025:03480-1
related SUSE-SU-2025:03482-1
related SUSE-SU-2025:03483-1
related SUSE-SU-2025:03485-1
related SUSE-SU-2025:03494-1
related SUSE-SU-2025:03495-1
related SUSE-SU-2025:03496-1
related SUSE-SU-2025:03497-1
related SUSE-SU-2025:03498-1
related SUSE-SU-2025:03503-1
related SUSE-SU-2025:03504-1
related SUSE-SU-2025:03514-1
related SUSE-SU-2025:03515-1
related SUSE-SU-2025:03528-1
related SUSE-SU-2025:03529-1
related SUSE-SU-2025:03538-1
related SUSE-SU-2025:03539-1
related SUSE-SU-2025:03541-1
related SUSE-SU-2025:03543-1
related SUSE-SU-2025:03548-1
related SUSE-SU-2025:03550-1
related SUSE-SU-2025:03551-1
related SUSE-SU-2025:03552-1
related SUSE-SU-2025:03553-1
related SUSE-SU-2025:03554-1
related SUSE-SU-2025:03555-1
related SUSE-SU-2025:03557-1
related SUSE-SU-2025:03559-1
related SUSE-SU-2025:03561-1
related SUSE-SU-2025:03562-1
related SUSE-SU-2025:03563-1
related SUSE-SU-2025:03566-1
related SUSE-SU-2025:03567-1
related SUSE-SU-2025:03568-1
related SUSE-SU-2025:03569-1
related SUSE-SU-2025:03571-1
related SUSE-SU-2025:03572-1
related SUSE-SU-2025:03575-1
related SUSE-SU-2025:03576-1
related SUSE-SU-2025:03577-1
related SUSE-SU-2025:03578-1
related SUSE-SU-2025:03580-1
related SUSE-SU-2025:03583-1
related SUSE-SU-2025:20577-1
related SUSE-SU-2025:20586-1
related SUSE-SU-2025:20601-1
related SUSE-SU-2025:20602-1
related SUSE-SU-2025:20806-1
related SUSE-SU-2025:20807-1
related SUSE-SU-2025:20808-1
related SUSE-SU-2025:20809-1
related SUSE-SU-2025:20810-1
related SUSE-SU-2025:20811-1
related SUSE-SU-2025:20812-1
related SUSE-SU-2025:20813-1
related SUSE-SU-2025:20814-1
related SUSE-SU-2025:20815-1
related SUSE-SU-2025:20816-1
related SUSE-SU-2025:20817-1
related SUSE-SU-2025:20818-1
related SUSE-SU-2025:20819-1
related SUSE-SU-2025:20820-1
related SUSE-SU-2025:20826-1
related SUSE-SU-2025:20827-1
related SUSE-SU-2025:20828-1
related SUSE-SU-2025:20829-1
related SUSE-SU-2025:20830-1
related SUSE-SU-2025:20831-1
related SUSE-SU-2025:20832-1
related SUSE-SU-2025:20833-1
related SUSE-SU-2025:20834-1
related SUSE-SU-2025:20835-1
related SUSE-SU-2025:20836-1
related SUSE-SU-2025:20837-1
related SUSE-SU-2025:20838-1
related SUSE-SU-2025:20839-1
related SUSE-SU-2025:20840-1
related SUSE-SU-2025:20841-1
related SUSE-SU-2025:20842-1
related SUSE-SU-2025:21074-1
related SUSE-SU-2025:21139-1
related SUSE-SU-2025:21179-1
related SUSE-SU-2025:4123-1

04 / EVIDENCE

Source records

Open Source Vulnerabilities CVE-2025-38477

In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_qfq: Fix race condition on qfq_aggregate A race condition can occur when 'agg' is modified in qfq_change_agg (called during qfq_enqueue) while other threads access it concurrently. For example, qfq_dump_class may trigger a NULL dereference, and qfq_delete_class may cause a use-after-free. This patch addresses the issue by: 1. Moved qfq_destroy_class into the critical section. 2. Added sch_tree_lock protection to qfq_dump_class and qfq_dump_class_stats.

View original source

05 / REFERENCES

Further evidence