OSV - Open Source Vulnerabilities

CVE-2025-38477

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-38477
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-38477.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2025-38477
Downstream
Related
Published
2025-07-28T11:21:38Z
Modified
2026-08-12T03:30:24Z
Severity
  • 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
net/sched: sch_qfq: Fix race condition on qfq_aggregate
Details

In the Linux kernel, the following vulnerability has been resolved:

net/sched: sch_qfq: Fix race condition on qfq_aggregate

A race condition can occur when 'agg' is modified in qfq_change_agg (called during qfq_enqueue) while other threads access it concurrently. For example, qfq_dump_class may trigger a NULL dereference, and qfq_delete_class may cause a use-after-free.

This patch addresses the issue by:

  1. Moved qfq_destroy_class into the critical section.

  2. Added sch_tree_lock protection to qfq_dump_class and qfq_dump_class_stats.

Database specific 
{
    "cna_assigner":  "Linux",
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/38xxx/CVE-2025-38477.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
462dbc9101acd38e92eda93c0726857517a24bbd
Fixed
aa7a22c4d678bf649fd3a1d27debec583563414d
Fixed
d841aa5518508ab195b6781ad0d73ee378d713dd
Fixed
c6df794000147a3a02f79984aada4ce83f8d0a1e
Fixed
466e10194ab81caa2ee6a332d33ba16bcceeeba6
Fixed
fbe48f06e64134dfeafa89ad23387f66ebca3527
Fixed
a6d735100f602c830c16d69fb6d780eebd8c9ae1
Fixed
c000a3a330d97f6c073ace5aa5faf94b9adb4b79
Fixed
5e28d5a3f774f118896aec17a3a20a9c5c9dfc64

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-38477.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
3.8.0
Fixed
5.4.297
Type
ECOSYSTEM
Events
Introduced
5.5.0
Fixed
5.10.241
Type
ECOSYSTEM
Events
Introduced
5.11.0
Fixed
5.15.190
Type
ECOSYSTEM
Events
Introduced
5.16.0
Fixed
6.1.147
Type
ECOSYSTEM
Events
Introduced
6.2.0
Fixed
6.6.100
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.12.40
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.15.8

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-38477.json"