Description
In the Linux kernel, the following vulnerability has been resolved: net_sched: red: fix a race in __red_change() Gerrard Tai reported a race condition in RED, whenever SFQ perturb timer fires at the wrong time. The race is as follows: CPU 0 CPU 1 [1]: lock root [2]: qdisc_tree_flush_backlog() [3]: unlock root | | [5]: lock root | [6]: rehash | [7]: qdisc_tree_reduce_backlog() | [4]: qdisc_put() This can be abused to underflow a parent's qlen. Calling qdisc_purge_queue() instead of qdisc_tree_flush_backlog() should fix the race, because all packets will be purged from the qdisc before releasing the lock.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
0c8d13ac96070000da33f394f45e9c19638483c5 to < 2790c4ec481be45a80948d059cd7c9a06bc37493affected0c8d13ac96070000da33f394f45e9c19638483c5 to < a1bf6a4e9264a685b0e642994031f9c5aad72414affected0c8d13ac96070000da33f394f45e9c19638483c5 to < 110a47efcf23438ff8d31dbd9c854fae2a48bf98affected0c8d13ac96070000da33f394f45e9c19638483c5 to < f569984417a4e12c67366e69bdcb752970de921daffected0c8d13ac96070000da33f394f45e9c19638483c5 to < 2a71924ca4af59ffc00f0444732b6cd54b153d0eaffected0c8d13ac96070000da33f394f45e9c19638483c5 to < 4b755305b2b0618e857fdadb499365b5f2e478d1affected0c8d13ac96070000da33f394f45e9c19638483c5 to < 444ad445df5496a785705019268a8a84b84484bbaffected0c8d13ac96070000da33f394f45e9c19638483c5 to < 85a3e0ede38450ea3053b8c45d28cf55208409b8affected
Linux Linux
Default version status: affected
5.0affected0 to < 5.0unaffected5.4.295 to ≤ 5.4.*unaffected5.10.239 to ≤ 5.10.*unaffected5.15.186 to ≤ 5.15.*unaffected6.1.142 to ≤ 6.1.*unaffected6.6.94 to ≤ 6.6.*unaffected6.12.34 to ≤ 6.12.*unaffected6.15.3 to ≤ 6.15.*unaffected6.16 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/2790c4ec481be45a80948d059cd7c9a06bc37493 ↗
- https://git.kernel.org/stable/c/a1bf6a4e9264a685b0e642994031f9c5aad72414 ↗
- https://git.kernel.org/stable/c/110a47efcf23438ff8d31dbd9c854fae2a48bf98 ↗
- https://git.kernel.org/stable/c/f569984417a4e12c67366e69bdcb752970de921d ↗
- https://git.kernel.org/stable/c/2a71924ca4af59ffc00f0444732b6cd54b153d0e ↗
- https://git.kernel.org/stable/c/4b755305b2b0618e857fdadb499365b5f2e478d1 ↗
- https://git.kernel.org/stable/c/444ad445df5496a785705019268a8a84b84484bb ↗
- https://git.kernel.org/stable/c/85a3e0ede38450ea3053b8c45d28cf55208409b8 ↗
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html ↗
- https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html ↗