Executive brief
A race condition was identified in the Linux kernel's network scheduling component. This flaw could allow a local attacker to cause a system instability or a denial-of-service condition by triggering specific timing issues during network queue management. The issue specifically affects systems using the PRIO (Priority) queuing discipline.
Technical details
A race condition exists in the prio_tune() function within net/sched/sch_prio.c of the Linux kernel. The vulnerability occurs when the SFQ (Stochastic Fairness Queueing) perturb timer fires during a PRIO configuration change. Specifically, a gap between qdisc_tree_flush_backlog() and qdisc_put() allows another CPU to acquire the root lock and perform a rehash, leading to an underflow of the parent's queue length (qlen). This is a concurrency issue (CWE-362) that can be exploited by a local user with sufficient privileges to manipulate network scheduling. The fix replaces qdisc_tree_flush_backlog() with qdisc_purge_queue() to ensure all packets are purged before the lock is released.
Affected products
- Linux Linux Kernel 5.0 to 5.4.295, 5.5 to 5.10.239, 5.11 to 5.15.186, 5.16 to 6.1.142, 6.2 to 6.6.94, 6.7 to 6.12.34, 6.13 to 6.15.3
Timeline
- 2025-06-11: patched: Initial patch submitted by Eric Dumazet
- 2025-06-20: disclosed: CVE-2025-38083 published
References
- https://git.kernel.org/stable/c/20f68e6a9e41693cb0e55e5b9ebbcb40983a4b8f
- https://git.kernel.org/stable/c/3aaa7c01cf19d9b9bb64b88b65c3a6fd05da2eb4
- https://git.kernel.org/stable/c/4483d8b9127591c60c4eb789d6cab953bc4522a9
- https://git.kernel.org/stable/c/46c15c9d0f65c9ba857d63f53264f4b17e8a715f
- https://git.kernel.org/stable/c/53d11560e957d53ee87a0653d258038ce12361b7
- https://git.kernel.org/stable/c/93f9eeb678d4c9c1abf720b3615fa8299a490845
- https://git.kernel.org/stable/c/d35acc1be3480505b5931f17e4ea9b7617fea4d3