Description
In the Linux kernel, the following vulnerability has been resolved: net_sched: ets: fix a race in ets_qdisc_change() Gerrard Tai reported a race condition in ETS, whenever SFQ perturb timer fires at the wrong time. The race is as follows: CPU 0 CPU 1 [1]: lock root [2]: qdisc_tree_flush_backlog() [3]: unlock root | | [5]: lock root | [6]: rehash | [7]: qdisc_tree_reduce_backlog() | [4]: qdisc_put() This can be abused to underflow a parent's qlen. Calling qdisc_purge_queue() instead of qdisc_tree_flush_backlog() should fix the race, because all packets will be purged from the qdisc before releasing the lock.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
699d82e9a6db29d509a71f1f2f4316231e6232e6 to < eb7b74e9754e1ba2088f914ad1f57a778b11894baffectedce881ddbdc028fb1988b66e40e45ca0529c23b46 to < 0b479d0aa488cb478eb2e1d8868be946ac8afb4faffectedb05972f01e7d30419987a1f221b5593668fd6448 to < 347867cb424edae5fec1622712c8dd0a2c42918faffectedb05972f01e7d30419987a1f221b5593668fd6448 to < 0383b25488a545be168744336847549d4a2d3d6caffectedb05972f01e7d30419987a1f221b5593668fd6448 to < 073f64c03516bcfaf790f8edc772e0cfb8a84ec3affectedb05972f01e7d30419987a1f221b5593668fd6448 to < fed94bd51d62d2e0e006aa61480e94e5cd0582b0affectedb05972f01e7d30419987a1f221b5593668fd6448 to < d92adacdd8c2960be856e0b82acc5b7c5395fddbaffectedfffa19b5e58c34004a0d6f642d9c24b11d213994affectedfb155f6597cd7bc3aeed668c3bb15fc3b7cb257daffected5.10.142 to < 5.10.239affected5.15.66 to < 5.15.186affected5.4.213 to < 5.5affected5.19.8 to < 5.20affected
Linux Linux
Default version status: affected
6.0affected0 to < 6.0unaffected5.10.239 to ≤ 5.10.*unaffected5.15.186 to ≤ 5.15.*unaffected6.1.142 to ≤ 6.1.*unaffected6.6.94 to ≤ 6.6.*unaffected6.12.34 to ≤ 6.12.*unaffected6.15.3 to ≤ 6.15.*unaffected6.16 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/eb7b74e9754e1ba2088f914ad1f57a778b11894b ↗
- https://git.kernel.org/stable/c/0b479d0aa488cb478eb2e1d8868be946ac8afb4f ↗
- https://git.kernel.org/stable/c/347867cb424edae5fec1622712c8dd0a2c42918f ↗
- https://git.kernel.org/stable/c/0383b25488a545be168744336847549d4a2d3d6c ↗
- https://git.kernel.org/stable/c/073f64c03516bcfaf790f8edc772e0cfb8a84ec3 ↗
- https://git.kernel.org/stable/c/fed94bd51d62d2e0e006aa61480e94e5cd0582b0 ↗
- https://git.kernel.org/stable/c/d92adacdd8c2960be856e0b82acc5b7c5395fddb ↗
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html ↗
- https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html ↗