CVE-2025-38083

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-38083
In the Linux kernel, the following vulnerability has been resolved: net_sched: prio: fix a race in prio_tune() Gerrard Tai reported a race condition in PRIO, whenever SFQ perturb timer fires at the wrong time. The race is as follows: CPU 0 CPU 1 [1]: lock root [2]: qdisc_tree_flush_backlog() [3]: unlock root | | [5]: lock root | [6]: rehash | [7]: qdisc_tree_reduce_backlog() | [4]: qdisc_put() This can be abused to underflow a parent's qlen. Calling qdisc_purge_queue() instead of qdisc_tree_flush_backlog() should fix the race, because all packets will be purged from the qdisc before releasing the lock.

4.7 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.0 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/20f68e6a9e41693cb0e55e5b9ebbcb40983a4b8f Patch
https://git.kernel.org/stable/c/3aaa7c01cf19d9b9bb64b88b65c3a6fd05da2eb4 Patch
https://git.kernel.org/stable/c/4483d8b9127591c60c4eb789d6cab953bc4522a9 Patch
https://git.kernel.org/stable/c/46c15c9d0f65c9ba857d63f53264f4b17e8a715f Patch
https://git.kernel.org/stable/c/53d11560e957d53ee87a0653d258038ce12361b7 Patch
https://git.kernel.org/stable/c/93f9eeb678d4c9c1abf720b3615fa8299a490845 Patch
https://git.kernel.org/stable/c/d35acc1be3480505b5931f17e4ea9b7617fea4d3 Patch
https://git.kernel.org/stable/c/e3f6745006dc9423d2b065b90f191cfa11b1b584 Patch
https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html Third Party Advisory
https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html Third Party Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
History

17 Dec 2025, 17:01

Type Values Removed Values Added
First Time Linux
Debian
Debian debian Linux
Linux linux Kernel
CWE CWE-362
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 4.7
CPE cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
References () https://git.kernel.org/stable/c/20f68e6a9e41693cb0e55e5b9ebbcb40983a4b8f - () https://git.kernel.org/stable/c/20f68e6a9e41693cb0e55e5b9ebbcb40983a4b8f - Patch
References () https://git.kernel.org/stable/c/3aaa7c01cf19d9b9bb64b88b65c3a6fd05da2eb4 - () https://git.kernel.org/stable/c/3aaa7c01cf19d9b9bb64b88b65c3a6fd05da2eb4 - Patch
References () https://git.kernel.org/stable/c/4483d8b9127591c60c4eb789d6cab953bc4522a9 - () https://git.kernel.org/stable/c/4483d8b9127591c60c4eb789d6cab953bc4522a9 - Patch
References () https://git.kernel.org/stable/c/46c15c9d0f65c9ba857d63f53264f4b17e8a715f - () https://git.kernel.org/stable/c/46c15c9d0f65c9ba857d63f53264f4b17e8a715f - Patch
References () https://git.kernel.org/stable/c/53d11560e957d53ee87a0653d258038ce12361b7 - () https://git.kernel.org/stable/c/53d11560e957d53ee87a0653d258038ce12361b7 - Patch
References () https://git.kernel.org/stable/c/93f9eeb678d4c9c1abf720b3615fa8299a490845 - () https://git.kernel.org/stable/c/93f9eeb678d4c9c1abf720b3615fa8299a490845 - Patch
References () https://git.kernel.org/stable/c/d35acc1be3480505b5931f17e4ea9b7617fea4d3 - () https://git.kernel.org/stable/c/d35acc1be3480505b5931f17e4ea9b7617fea4d3 - Patch
References () https://git.kernel.org/stable/c/e3f6745006dc9423d2b065b90f191cfa11b1b584 - () https://git.kernel.org/stable/c/e3f6745006dc9423d2b065b90f191cfa11b1b584 - Patch
References () https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html - () https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html - Third Party Advisory
References () https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html - () https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html - Third Party Advisory

03 Nov 2025, 18:16

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html -
  • () https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html -

27 Jun 2025, 11:15

Type Values Removed Values Added
References
  • () https://git.kernel.org/stable/c/20f68e6a9e41693cb0e55e5b9ebbcb40983a4b8f -
  • () https://git.kernel.org/stable/c/3aaa7c01cf19d9b9bb64b88b65c3a6fd05da2eb4 -
  • () https://git.kernel.org/stable/c/4483d8b9127591c60c4eb789d6cab953bc4522a9 -
  • () https://git.kernel.org/stable/c/53d11560e957d53ee87a0653d258038ce12361b7 -

23 Jun 2025, 20:16

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net_sched: prio: corrige una ejecución en prio_tune() Gerrard Tai informó una condición de ejecución en PRIO, siempre que el temporizador de perturbación SFQ se dispara en el momento equivocado. La ejecución es la siguiente: CPU 0 CPU 1 [1]: raíz de bloqueo [2]: qdisc_tree_flush_backlog() [3]: raíz de desbloqueo | | [5]: raíz de bloqueo | [6]: rehash | [7]: qdisc_tree_reduce_backlog() | [4]: qdisc_put() Esto se puede abusar para desbordar el qlen de un padre. Llamar a qdisc_purge_queue() en lugar de qdisc_tree_flush_backlog() debería corregir la ejecución, porque todos los paquetes se purgarán del qdisc antes de liberar el bloqueo.

20 Jun 2025, 12:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-06-20 12:15

Updated : 2025-12-17 17:01

NVD link : CVE-2025-38083

Mitre link : CVE-2025-38083

CVE.ORG link : CVE-2025-38083

JSON object : View

Products Affected

debian

  • debian_linux

linux

  • linux_kernel
CWE
CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')