{"id":"CVE-2025-38477","title":"net/sched: sch_qfq: Fix race condition on qfq_aggregate","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: sch_qfq: Fix race condition on qfq_aggregate\n\nA race condition can occur when 'agg' is modified in qfq_change_agg\n(called during qfq_enqueue) while other thr…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= 462dbc9101acd38e92eda93c0726857517a24bbd < aa7a22c4d678bf649fd3a1d27debec583563414d","Linux >= 462dbc9101acd38e92eda93c0726857517a24bbd < d841aa5518508ab195b6781ad0d73ee378d713dd","Linux >= 462dbc9101acd38e92eda93c0726857517a24bbd < c6df794000147a3a02f79984aada4ce83f8d0a1e","Linux >= 462dbc9101acd38e92eda93c0726857517a24bbd < 466e10194ab81caa2ee6a332d33ba16bcceeeba6","Linux >= 462dbc9101acd38e92eda93c0726857517a24bbd < fbe48f06e64134dfeafa89ad23387f66ebca3527","Linux >= 462dbc9101acd38e92eda93c0726857517a24bbd < a6d735100f602c830c16d69fb6d780eebd8c9ae1","Linux >= 462dbc9101acd38e92eda93c0726857517a24bbd < c000a3a330d97f6c073ace5aa5faf94b9adb4b79","Linux >= 462dbc9101acd38e92eda93c0726857517a24bbd < 5e28d5a3f774f118896aec17a3a20a9c5c9dfc64","Linux 3.8"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-06-10T20:41:44.296535Z"},"published":"2025-07-28","updated":"2026-10-15","sourceUpdated":"2026-10-15T01:07:26.004Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-38477","references":[{"url":"https://git.kernel.org/stable/c/aa7a22c4d678bf649fd3a1d27debec583563414d"},{"url":"https://git.kernel.org/stable/c/d841aa5518508ab195b6781ad0d73ee378d713dd"},{"url":"https://git.kernel.org/stable/c/c6df794000147a3a02f79984aada4ce83f8d0a1e"},{"url":"https://git.kernel.org/stable/c/466e10194ab81caa2ee6a332d33ba16bcceeeba6"},{"url":"https://git.kernel.org/stable/c/fbe48f06e64134dfeafa89ad23387f66ebca3527"},{"url":"https://git.kernel.org/stable/c/a6d735100f602c830c16d69fb6d780eebd8c9ae1"},{"url":"https://git.kernel.org/stable/c/c000a3a330d97f6c073ace5aa5faf94b9adb4b79"},{"url":"https://git.kernel.org/stable/c/5e28d5a3f774f118896aec17a3a20a9c5c9dfc64"}],"tags":["cve.org"],"epss":0.00132,"epssPercentile":0.0272,"ingestedAt":"2026-10-15T05:52:46.085Z","slug":"CVE-2025-38477","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: sch_qfq: Fix race condition on qfq_aggregate\n\nA race condition can occur when 'agg' is modified in qfq_change_agg\n(called during qfq_enqueue) while other threads access it\nconcurrently. For example, qfq_dump_class may trigger a NULL\ndereference, and qfq_delete_class may cause a use-after-free.\n\nThis patch addresses the issue by:\n\n1. Moved qfq_destroy_class into the critical section.\n\n2. Added sch_tree_lock protection to qfq_dump_class and\nqfq_dump_class_stats.\n\n## Affected\n\n- `Linux >= 462dbc9101acd38e92eda93c0726857517a24bbd < aa7a22c4d678bf649fd3a1d27debec583563414d`\n- `Linux >= 462dbc9101acd38e92eda93c0726857517a24bbd < d841aa5518508ab195b6781ad0d73ee378d713dd`\n- `Linux >= 462dbc9101acd38e92eda93c0726857517a24bbd < c6df794000147a3a02f79984aada4ce83f8d0a1e`\n- `Linux >= 462dbc9101acd38e92eda93c0726857517a24bbd < 466e10194ab81caa2ee6a332d33ba16bcceeeba6`\n- `Linux >= 462dbc9101acd38e92eda93c0726857517a24bbd < fbe48f06e64134dfeafa89ad23387f66ebca3527`\n- `Linux >= 462dbc9101acd38e92eda93c0726857517a24bbd < a6d735100f602c830c16d69fb6d780eebd8c9ae1`\n- `Linux >= 462dbc9101acd38e92eda93c0726857517a24bbd < c000a3a330d97f6c073ace5aa5faf94b9adb4b79`\n- `Linux >= 462dbc9101acd38e92eda93c0726857517a24bbd < 5e28d5a3f774f118896aec17a3a20a9c5c9dfc64`\n- `Linux 3.8`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}