Race Condition Vulnerability in Linux Kernel Affects Network Scheduler Components

CVE-2025-38477

What is CVE-2025-38477?

A race condition vulnerability resides in the Linux kernel's network scheduler components, specifically related to the qfq_aggregate function. This issue manifests when the 'agg' structure is concurrently accessed and modified by multiple threads during network packet handling. Scenarios such as qfq_dump_class can lead to a NULL dereference, while qfq_delete_class could create a use-after-free vulnerability. The recent patch implements essential protections by ensuring the qfq_destroy_class operation occurs within a critical section and adding sch_tree_lock safeguards around critical functions like qfq_dump_class and qfq_dump_class_stats, thereby mitigating potential risks.

References