In the Linux kernel, the following vulnerability has been resolved: netsched: red: fix a race in _redchange() Gerrard Tai reported a race condition in RED, whenever SFQ perturb timer fires at the wrong time. The race is as follows: CPU 0 CPU 1 [1]: lock root [2]: qdisctreeflushbacklog() [3]: unlock root | | [5]: lock root | [6]: rehash | [7]: qdisctreereducebacklog() | [4]: qdiscput() This can be abused to underflow a parent's qlen. Calling qdiscpurgequeue() instead of qdisctreeflush_backlog() should fix the race, because all packets will be purged from the qdisc before releasing the lock.