In the Linux kernel, the following vulnerability has been resolved:
netsched: prio: fix a race in priotune()
Gerrard Tai reported a race condition in PRIO, whenever SFQ perturb timer fires at the wrong time.
The race is as follows:
CPU 0 CPU 1 | | [5]: lock root | [6]: rehash | [7]: qdisctreereduce_backlog() | This can be abused to underflow a parent's qlen.
Calling qdiscpurgequeue() instead of qdisctreeflush_backlog() should fix the race, because all packets will be purged from the qdisc before releasing the lock.
[
{
"id": "CVE-2025-38083-bbef8615",
"signature_type": "Line",
"signature_version": "v1",
"target": {
"file": "net/sched/sch_prio.c"
},
"digest": {
"line_hashes": [
"61933998598420471594689949432959531361",
"25196573829403813580139109200312666258",
"190388038944360222812270987064504484411",
"135128721371664461522899876693853744910"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d35acc1be3480505b5931f17e4ea9b7617fea4d3",
"deprecated": false
}
]