CVE-2025-38107

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net_sched: ets: fix a race in ets_qdisc_change()<br /> <br /> Gerrard Tai reported a race condition in ETS, whenever SFQ perturb timer<br /> fires at the wrong time.<br /> <br /> The race is as follows:<br /> <br /> CPU 0 CPU 1<br /> [1]: lock root<br /> [2]: qdisc_tree_flush_backlog()<br /> [3]: unlock root<br /> |<br /> | [5]: lock root<br /> | [6]: rehash<br /> | [7]: qdisc_tree_reduce_backlog()<br /> |<br /> [4]: qdisc_put()<br /> <br /> This can be abused to underflow a parent&amp;#39;s qlen.<br /> <br /> Calling qdisc_purge_queue() instead of qdisc_tree_flush_backlog()<br /> should fix the race, because all packets will be purged from the qdisc<br /> before releasing the lock.