Race Condition in Linux Kernel's Scheduling Subsystem

CVE-2025-38083

What is CVE-2025-38083?

A race condition exists within the Linux kernel's scheduling subsystem, specifically involving the priority scheduling (prio) mechanism. This issue arises when the Stochastic Fair Queuing (SFQ) perturb timer triggers in an inappropriate sequence, allowing for potential abuse that leads to underflow in the parent's queue length (qlen). The flaw occurs during the process of flushing the backlog of queued packets, which may be exploited to disrupt normal network operations. To mitigate this, invoking qdisc_purge_queue() instead of qdisc_tree_flush_backlog() is recommended to ensure all packets are cleared before releasing the lock, thus safeguarding against this timing issue.

References