---
id: CVE-2025-38477
title: 'net/sched: sch_qfq: Fix race condition on qfq_aggregate'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  net/sched: sch_qfq: Fix race condition on qfq_aggregate

  A race condition can occur when 'agg' is modified in qfq_change_agg
  (called during qfq_enqueue) while other thr…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 462dbc9101acd38e92eda93c0726857517a24bbd <
    aa7a22c4d678bf649fd3a1d27debec583563414d
  - >-
    Linux >= 462dbc9101acd38e92eda93c0726857517a24bbd <
    d841aa5518508ab195b6781ad0d73ee378d713dd
  - >-
    Linux >= 462dbc9101acd38e92eda93c0726857517a24bbd <
    c6df794000147a3a02f79984aada4ce83f8d0a1e
  - >-
    Linux >= 462dbc9101acd38e92eda93c0726857517a24bbd <
    466e10194ab81caa2ee6a332d33ba16bcceeeba6
  - >-
    Linux >= 462dbc9101acd38e92eda93c0726857517a24bbd <
    fbe48f06e64134dfeafa89ad23387f66ebca3527
  - >-
    Linux >= 462dbc9101acd38e92eda93c0726857517a24bbd <
    a6d735100f602c830c16d69fb6d780eebd8c9ae1
  - >-
    Linux >= 462dbc9101acd38e92eda93c0726857517a24bbd <
    c000a3a330d97f6c073ace5aa5faf94b9adb4b79
  - >-
    Linux >= 462dbc9101acd38e92eda93c0726857517a24bbd <
    5e28d5a3f774f118896aec17a3a20a9c5c9dfc64
  - Linux 3.8
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-06-10T20:41:44.296535Z'
published: '2025-07-28'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T01:07:26.004Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-38477'
references:
  - url: 'https://git.kernel.org/stable/c/aa7a22c4d678bf649fd3a1d27debec583563414d'
  - url: 'https://git.kernel.org/stable/c/d841aa5518508ab195b6781ad0d73ee378d713dd'
  - url: 'https://git.kernel.org/stable/c/c6df794000147a3a02f79984aada4ce83f8d0a1e'
  - url: 'https://git.kernel.org/stable/c/466e10194ab81caa2ee6a332d33ba16bcceeeba6'
  - url: 'https://git.kernel.org/stable/c/fbe48f06e64134dfeafa89ad23387f66ebca3527'
  - url: 'https://git.kernel.org/stable/c/a6d735100f602c830c16d69fb6d780eebd8c9ae1'
  - url: 'https://git.kernel.org/stable/c/c000a3a330d97f6c073ace5aa5faf94b9adb4b79'
  - url: 'https://git.kernel.org/stable/c/5e28d5a3f774f118896aec17a3a20a9c5c9dfc64'
tags:
  - cve.org
epss: 0.00132
epssPercentile: 0.0272
ingestedAt: '2026-10-15T05:52:46.085Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

net/sched: sch_qfq: Fix race condition on qfq_aggregate

A race condition can occur when 'agg' is modified in qfq_change_agg
(called during qfq_enqueue) while other threads access it
concurrently. For example, qfq_dump_class may trigger a NULL
dereference, and qfq_delete_class may cause a use-after-free.

This patch addresses the issue by:

1. Moved qfq_destroy_class into the critical section.

2. Added sch_tree_lock protection to qfq_dump_class and
qfq_dump_class_stats.

## Affected

- `Linux >= 462dbc9101acd38e92eda93c0726857517a24bbd < aa7a22c4d678bf649fd3a1d27debec583563414d`
- `Linux >= 462dbc9101acd38e92eda93c0726857517a24bbd < d841aa5518508ab195b6781ad0d73ee378d713dd`
- `Linux >= 462dbc9101acd38e92eda93c0726857517a24bbd < c6df794000147a3a02f79984aada4ce83f8d0a1e`
- `Linux >= 462dbc9101acd38e92eda93c0726857517a24bbd < 466e10194ab81caa2ee6a332d33ba16bcceeeba6`
- `Linux >= 462dbc9101acd38e92eda93c0726857517a24bbd < fbe48f06e64134dfeafa89ad23387f66ebca3527`
- `Linux >= 462dbc9101acd38e92eda93c0726857517a24bbd < a6d735100f602c830c16d69fb6d780eebd8c9ae1`
- `Linux >= 462dbc9101acd38e92eda93c0726857517a24bbd < c000a3a330d97f6c073ace5aa5faf94b9adb4b79`
- `Linux >= 462dbc9101acd38e92eda93c0726857517a24bbd < 5e28d5a3f774f118896aec17a3a20a9c5c9dfc64`
- `Linux 3.8`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.