In the Linux kernel, the following vulnerability has been resolved:
netsched: red: fix a race in _red_change()
Gerrard Tai reported a race condition in RED, whenever SFQ perturb timer fires at the wrong time.
The race is as follows:
CPU 0 CPU 1 | | [5]: lock root | [6]: rehash | [7]: qdisctreereduce_backlog() | This can be abused to underflow a parent's qlen.
Calling qdiscpurgequeue() instead of qdisctreeflush_backlog() should fix the race, because all packets will be purged from the qdisc before releasing the lock.
[
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"307492377693060067379901820942145990452",
"180415724337554835957949924524661867540",
"185177157804334123054466106163484420836",
"31063083944858083331145447287242562200"
]
},
"target": {
"file": "net/sched/sch_red.c"
},
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@85a3e0ede38450ea3053b8c45d28cf55208409b8",
"id": "CVE-2025-38108-12ea9488"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"307492377693060067379901820942145990452",
"180415724337554835957949924524661867540",
"185177157804334123054466106163484420836",
"31063083944858083331145447287242562200"
]
},
"target": {
"file": "net/sched/sch_red.c"
},
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f569984417a4e12c67366e69bdcb752970de921d",
"id": "CVE-2025-38108-1488ab1c"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"307492377693060067379901820942145990452",
"180415724337554835957949924524661867540",
"185177157804334123054466106163484420836",
"31063083944858083331145447287242562200"
]
},
"target": {
"file": "net/sched/sch_red.c"
},
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@444ad445df5496a785705019268a8a84b84484bb",
"id": "CVE-2025-38108-46f65d7d"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"307492377693060067379901820942145990452",
"180415724337554835957949924524661867540",
"185177157804334123054466106163484420836",
"31063083944858083331145447287242562200"
]
},
"target": {
"file": "net/sched/sch_red.c"
},
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2a71924ca4af59ffc00f0444732b6cd54b153d0e",
"id": "CVE-2025-38108-65752822"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"88853590619216873383269398414794454650",
"180415724337554835957949924524661867540",
"185177157804334123054466106163484420836",
"31063083944858083331145447287242562200"
]
},
"target": {
"file": "net/sched/sch_red.c"
},
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2790c4ec481be45a80948d059cd7c9a06bc37493",
"id": "CVE-2025-38108-65dd4ea5"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"307492377693060067379901820942145990452",
"180415724337554835957949924524661867540",
"185177157804334123054466106163484420836",
"31063083944858083331145447287242562200"
]
},
"target": {
"file": "net/sched/sch_red.c"
},
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a1bf6a4e9264a685b0e642994031f9c5aad72414",
"id": "CVE-2025-38108-8d5a91f1"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"307492377693060067379901820942145990452",
"180415724337554835957949924524661867540",
"185177157804334123054466106163484420836",
"31063083944858083331145447287242562200"
]
},
"target": {
"file": "net/sched/sch_red.c"
},
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4b755305b2b0618e857fdadb499365b5f2e478d1",
"id": "CVE-2025-38108-9c5727fa"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"307492377693060067379901820942145990452",
"180415724337554835957949924524661867540",
"185177157804334123054466106163484420836",
"31063083944858083331145447287242562200"
]
},
"target": {
"file": "net/sched/sch_red.c"
},
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@110a47efcf23438ff8d31dbd9c854fae2a48bf98",
"id": "CVE-2025-38108-a34d0608"
}
]