{"id":"CVE-2025-38477","state":"PUBLISHED","title":"net/sched: sch_qfq: Fix race condition on qfq_aggregate","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: sch_qfq: Fix race condition on qfq_aggregate\n\nA race condition can occur when 'agg' is modified in qfq_change_agg\n(called during qfq_enqueue) while other threads access it\nconcurrently. For example, qfq_dump_class may trigger a NULL\ndereference, and qfq_delete_class may cause a use-after-free.\n\nThis patch addresses the issue by:\n\n1. Moved qfq_destroy_class into the critical section.\n\n2. Added sch_tree_lock protection to qfq_dump_class and\nqfq_dump_class_stats.","publishedAt":"2025-07-28T11:21:38.319Z","updatedAt":"2026-10-15T01:07:26.004Z","severity":{"score":7.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"462dbc9101acd38e92eda93c0726857517a24bbd","status":"affected","lessThan":"aa7a22c4d678bf649fd3a1d27debec583563414d","versionType":"git"},{"version":"462dbc9101acd38e92eda93c0726857517a24bbd","status":"affected","lessThan":"d841aa5518508ab195b6781ad0d73ee378d713dd","versionType":"git"},{"version":"462dbc9101acd38e92eda93c0726857517a24bbd","status":"affected","lessThan":"c6df794000147a3a02f79984aada4ce83f8d0a1e","versionType":"git"},{"version":"462dbc9101acd38e92eda93c0726857517a24bbd","status":"affected","lessThan":"466e10194ab81caa2ee6a332d33ba16bcceeeba6","versionType":"git"},{"version":"462dbc9101acd38e92eda93c0726857517a24bbd","status":"affected","lessThan":"fbe48f06e64134dfeafa89ad23387f66ebca3527","versionType":"git"},{"version":"462dbc9101acd38e92eda93c0726857517a24bbd","status":"affected","lessThan":"a6d735100f602c830c16d69fb6d780eebd8c9ae1","versionType":"git"},{"version":"462dbc9101acd38e92eda93c0726857517a24bbd","status":"affected","lessThan":"c000a3a330d97f6c073ace5aa5faf94b9adb4b79","versionType":"git"},{"version":"462dbc9101acd38e92eda93c0726857517a24bbd","status":"affected","lessThan":"5e28d5a3f774f118896aec17a3a20a9c5c9dfc64","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/sched/sch_qfq.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"3.8","status":"affected"},{"version":"0","status":"unaffected","lessThan":"3.8","versionType":"semver"},{"version":"5.4.297","status":"unaffected","lessThanOrEqual":"5.4.*","versionType":"semver"},{"version":"5.10.241","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.190","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.147","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.100","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.40","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.15.8","status":"unaffected","lessThanOrEqual":"6.15.*","versionType":"semver"},{"version":"6.16","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/sched/sch_qfq.c"]}],"references":["https://git.kernel.org/stable/c/aa7a22c4d678bf649fd3a1d27debec583563414d","https://git.kernel.org/stable/c/d841aa5518508ab195b6781ad0d73ee378d713dd","https://git.kernel.org/stable/c/c6df794000147a3a02f79984aada4ce83f8d0a1e","https://git.kernel.org/stable/c/466e10194ab81caa2ee6a332d33ba16bcceeeba6","https://git.kernel.org/stable/c/fbe48f06e64134dfeafa89ad23387f66ebca3527","https://git.kernel.org/stable/c/a6d735100f602c830c16d69fb6d780eebd8c9ae1","https://git.kernel.org/stable/c/c000a3a330d97f6c073ace5aa5faf94b9adb4b79","https://git.kernel.org/stable/c/5e28d5a3f774f118896aec17a3a20a9c5c9dfc64","https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html","https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html","https://cert-portal.siemens.com/productcert/html/ssa-082556.html"],"weaknesses":[],"ingestedAt":"2026-10-29T20:09:09.358Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/38xxx/CVE-2025-38477.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-38477","state":"PUBLISHED","datePublished":"2025-07-28T11:21:38.319Z","dateUpdated":"2026-10-15T01:07:26.004Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2025-04-16T04:51:24.021Z"},"containers":{"cna":{"title":"net/sched: sch_qfq: Fix race condition on qfq_aggregate","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: sch_qfq: Fix race condition on qfq_aggregate\n\nA race condition can occur when 'agg' is modified in qfq_change_agg\n(called during qfq_enqueue) while other threads access it\nconcurrently. For example, qfq_dump_class may trigger a NULL\ndereference, and qfq_delete_class may cause a use-after-free.\n\nThis patch addresses the issue by:\n\n1. Moved qfq_destroy_class into the critical section.\n\n2. Added sch_tree_lock protection to qfq_dump_class and\nqfq_dump_class_stats."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"462dbc9101acd38e92eda93c0726857517a24bbd","status":"affected","lessThan":"aa7a22c4d678bf649fd3a1d27debec583563414d","versionType":"git"},{"version":"462dbc9101acd38e92eda93c0726857517a24bbd","status":"affected","lessThan":"d841aa5518508ab195b6781ad0d73ee378d713dd","versionType":"git"},{"version":"462dbc9101acd38e92eda93c0726857517a24bbd","status":"affected","lessThan":"c6df794000147a3a02f79984aada4ce83f8d0a1e","versionType":"git"},{"version":"462dbc9101acd38e92eda93c0726857517a24bbd","status":"affected","lessThan":"466e10194ab81caa2ee6a332d33ba16bcceeeba6","versionType":"git"},{"version":"462dbc9101acd38e92eda93c0726857517a24bbd","status":"affected","lessThan":"fbe48f06e64134dfeafa89ad23387f66ebca3527","versionType":"git"},{"version":"462dbc9101acd38e92eda93c0726857517a24bbd","status":"affected","lessThan":"a6d735100f602c830c16d69fb6d780eebd8c9ae1","versionType":"git"},{"version":"462dbc9101acd38e92eda93c0726857517a24bbd","status":"affected","lessThan":"c000a3a330d97f6c073ace5aa5faf94b9adb4b79","versionType":"git"},{"version":"462dbc9101acd38e92eda93c0726857517a24bbd","status":"affected","lessThan":"5e28d5a3f774f118896aec17a3a20a9c5c9dfc64","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/sched/sch_qfq.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"3.8","status":"affected"},{"version":"0","status":"unaffected","lessThan":"3.8","versionType":"semver"},{"version":"5.4.297","status":"unaffected","lessThanOrEqual":"5.4.*","versionType":"semver"},{"version":"5.10.241","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.190","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.147","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.100","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.40","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.15.8","status":"unaffected","lessThanOrEqual":"6.15.*","versionType":"semver"},{"version":"6.16","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/sched/sch_qfq.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/aa7a22c4d678bf649fd3a1d27debec583563414d"},{"url":"https://git.kernel.org/stable/c/d841aa5518508ab195b6781ad0d73ee378d713dd"},{"url":"https://git.kernel.org/stable/c/c6df794000147a3a02f79984aada4ce83f8d0a1e"},{"url":"https://git.kernel.org/stable/c/466e10194ab81caa2ee6a332d33ba16bcceeeba6"},{"url":"https://git.kernel.org/stable/c/fbe48f06e64134dfeafa89ad23387f66ebca3527"},{"url":"https://git.kernel.org/stable/c/a6d735100f602c830c16d69fb6d780eebd8c9ae1"},{"url":"https://git.kernel.org/stable/c/c000a3a330d97f6c073ace5aa5faf94b9adb4b79"},{"url":"https://git.kernel.org/stable/c/5e28d5a3f774f118896aec17a3a20a9c5c9dfc64"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable paths are reached via local RTM_NEWTCLASS/DELTCLASS/GETTCLASS netlink operations on a qfq qdisc raced against local packet transmission through that qdisc. No remote peer input is involved.\nAC:L - The attacker controls both sides of the race — one thread continuously transmits packets larger than the class lmax to force qfq_change_agg() from qfq_enqueue(), while another loops tc class show/change/delete — so the window can be hit reliably by repetition on an attacker-owned netdev.\nPR:L - tc class manipulation requires CAP_NET_ADMIN, but rtnetlink checks netlink_net_capable() against the netns user_ns, so an unprivileged user obtains it with `unshare -Urn` and can build the entire qfq/veth setup inside that namespace.\nUI:N - The attacker performs every step itself — creating the qdisc, the class, the filter, and both racing threads. No victim action is needed.\nS:U - The corruption is confined to kernel heap objects within the same kernel security authority; there is no VM, IOMMU, or sandbox boundary crossed.\nC:H - qfq_dump_class()/qfq_dump_class_stats() read class_weight and lmax from an already-freed qfq_aggregate and copy them to userspace via netlink, and the broader use-after-free on a generic kmalloc slab object can be groomed into an arbitrary kernel-memory read primitive.\nI:H - The unlocked qfq_rm_from_agg()/qfq_update_agg()/qfq_destroy_agg() in qfq_delete_class() write into a concurrently freed aggregate (list unlink plus several field stores) and can double-free it, giving heap-spray-based write primitives suitable for control-flow hijack and privilege escalation.\nA:H - The race trivially produces a NULL pointer dereference on cl->agg, a use-after-free oops, a double free, or a divide-by-zero from corrupted num_classes/wsum, any of which panics the kernel."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-05T12:02:14.405Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.8","versionEndExcluding":"5.4.297"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.8","versionEndExcluding":"5.10.241"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.8","versionEndExcluding":"5.15.190"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.8","versionEndExcluding":"6.1.147"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.8","versionEndExcluding":"6.6.100"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.8","versionEndExcluding":"6.12.40"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.8","versionEndExcluding":"6.15.8"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.8","versionEndExcluding":"6.16"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"},{"url":"https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2025-11-03T17:38:44.755Z"}},{"affected":[{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.5","status":"affected","lessThan":"*","versionType":"custom"}]},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.5","status":"affected","lessThan":"*","versionType":"custom"}]},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.5","status":"affected","lessThan":"*","versionType":"custom"}]},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.5","status":"affected","lessThan":"*","versionType":"custom"}]},{"vendor":"Siemens","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.5","status":"affected","lessThan":"*","versionType":"custom"}]}],"references":[{"url":"https://cert-portal.siemens.com/productcert/html/ssa-082556.html"}],"providerMetadata":{"shortName":"siemens-SADP","orgId":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","dateUpdated":"2026-10-15T01:07:26.004Z"},"x_adpType":"supplier"},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2025-38477","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-06-10T20:41:44.296535Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-06-11T18:44:15.653Z"}}]}}}