Description
In the Linux kernel, the following vulnerability has been resolved: net_sched: prio: fix a race in prio_tune() Gerrard Tai reported a race condition in PRIO, whenever SFQ perturb timer fires at the wrong time. The race is as follows: CPU 0 CPU 1 [1]: lock root [2]: qdisc_tree_flush_backlog() [3]: unlock root | | [5]: lock root | [6]: rehash | [7]: qdisc_tree_reduce_backlog() | [4]: qdisc_put() This can be abused to underflow a parent's qlen. Calling qdisc_purge_queue() instead of qdisc_tree_flush_backlog() should fix the race, because all packets will be purged from the qdisc before releasing the lock.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
7b8e0b6e659983154c8d7e756cdb833d89a3d4d7 to < 53d11560e957d53ee87a0653d258038ce12361b7affected7b8e0b6e659983154c8d7e756cdb833d89a3d4d7 to < 4483d8b9127591c60c4eb789d6cab953bc4522a9affected7b8e0b6e659983154c8d7e756cdb833d89a3d4d7 to < 20f68e6a9e41693cb0e55e5b9ebbcb40983a4b8faffected7b8e0b6e659983154c8d7e756cdb833d89a3d4d7 to < 3aaa7c01cf19d9b9bb64b88b65c3a6fd05da2eb4affected7b8e0b6e659983154c8d7e756cdb833d89a3d4d7 to < 46c15c9d0f65c9ba857d63f53264f4b17e8a715faffected7b8e0b6e659983154c8d7e756cdb833d89a3d4d7 to < e3f6745006dc9423d2b065b90f191cfa11b1b584affected7b8e0b6e659983154c8d7e756cdb833d89a3d4d7 to < 93f9eeb678d4c9c1abf720b3615fa8299a490845affected7b8e0b6e659983154c8d7e756cdb833d89a3d4d7 to < d35acc1be3480505b5931f17e4ea9b7617fea4d3affected
Linux Linux
Default version status: affected
5.0affected0 to < 5.0unaffected5.4.295 to ≤ 5.4.*unaffected5.10.239 to ≤ 5.10.*unaffected5.15.186 to ≤ 5.15.*unaffected6.1.142 to ≤ 6.1.*unaffected6.6.94 to ≤ 6.6.*unaffected6.12.34 to ≤ 6.12.*unaffected6.15.3 to ≤ 6.15.*unaffected6.16 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/53d11560e957d53ee87a0653d258038ce12361b7 ↗
- https://git.kernel.org/stable/c/4483d8b9127591c60c4eb789d6cab953bc4522a9 ↗
- https://git.kernel.org/stable/c/20f68e6a9e41693cb0e55e5b9ebbcb40983a4b8f ↗
- https://git.kernel.org/stable/c/3aaa7c01cf19d9b9bb64b88b65c3a6fd05da2eb4 ↗
- https://git.kernel.org/stable/c/46c15c9d0f65c9ba857d63f53264f4b17e8a715f ↗
- https://git.kernel.org/stable/c/e3f6745006dc9423d2b065b90f191cfa11b1b584 ↗
- https://git.kernel.org/stable/c/93f9eeb678d4c9c1abf720b3615fa8299a490845 ↗
- https://git.kernel.org/stable/c/d35acc1be3480505b5931f17e4ea9b7617fea4d3 ↗
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html ↗
- https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html ↗
- https://cert-portal.siemens.com/productcert/html/ssa-082556.html ↗