{"id":"CVE-2025-38193","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet_sched: sch_sfq: reject invalid perturb period\n\nGerrard Tai reported that SFQ perturb_period has no range check yet,\nand this can be used to trigger a race condition…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet_sched: sch_sfq: reject invalid perturb period\n\nGerrard Tai reported that SFQ perturb_period has no range check yet,\nand this can be used to trigger a race condition…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-190"],"vendor":"linux","product":"linux_kernel","affected":["linux_kernel >= 2.6.13, < 5.4.297","linux_kernel >= 5.5, < 5.10.240","linux_kernel >= 5.11, < 5.15.186","linux_kernel >= 5.16, < 6.1.142","linux_kernel >= 6.2, < 6.6.95","linux_kernel >= 6.7, < 6.12.35","linux_kernel >= 6.13, < 6.15.4","linux_kernel = 2.6.12","linux_kernel = 6.16","debian_linux = 11.0"],"patched":["linux_kernel 6.15.4"],"published":"2025-07-04","updated":"2026-10-15","sourceUpdated":"2026-10-15T22:18:34.207","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-38193","references":[{"url":"https://git.kernel.org/stable/c/0357da9149eac621f39e235a135ebf155f01f7c3","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2254d038dab9c194fe6a4b1ce31034f42e91a6e5","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/590b2d7d0beadba2aa576708a05a05f0aae39295","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7ca52541c05c832d32b112274f81a985101f9ba8","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/956b5aebb349449b38d920d444ca1392d43719d1","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b11a50544af691b787384089b68f740ae20a441b","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e0936ff56be4e08ad5b60ec26971eae0c40af305","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f9b97d466e6026ccbdda30bb5b71965b67ccbc82","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html","label":"af854a3a-2127-422b-91ae-364da2661108"}],"tags":["nvd","cve.org"],"epss":0.00205,"epssPercentile":0.1037,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-15T21:48:23.009487Z"},"ingestedAt":"2026-10-15T22:48:25.498Z","slug":"CVE-2025-38193","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet_sched: sch_sfq: reject invalid perturb period\n\nGerrard Tai reported that SFQ perturb_period has no range check yet,\nand this can be used to trigger a race condition fixed in a separate patch.\n\nWe want to make sure ctl->perturb_period * HZ will not overflow\nand is positive.\n\n\ntc qd add dev lo root sfq perturb -10   # negative value : error\nError: sch_sfq: invalid perturb period.\n\ntc qd add dev lo root sfq perturb 1000000000 # too big : error\nError: sch_sfq: invalid perturb period.\n\ntc qd add dev lo root sfq perturb 2000000 # acceptable value\ntc -s -d qd sh dev lo\nqdisc sfq 8005: root refcnt 2 limit 127p quantum 64Kb depth 127 flows 128 divisor 1024 perturb 2000000sec\n Sent 0 bytes 0 pkt (dropped 0, overlimits 0 requeues 0)\n backlog 0b 0p requeues 0\n\n## Affected\n\n- `linux_kernel >= 2.6.13, < 5.4.297`\n- `linux_kernel >= 5.5, < 5.10.240`\n- `linux_kernel >= 5.11, < 5.15.186`\n- `linux_kernel >= 5.16, < 6.1.142`\n- `linux_kernel >= 6.2, < 6.6.95`\n- `linux_kernel >= 6.7, < 6.12.35`\n- `linux_kernel >= 6.13, < 6.15.4`\n- `linux_kernel = 2.6.12`\n- `linux_kernel = 6.16`\n- `debian_linux = 11.0`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `linux_kernel 6.15.4`","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}