Executive brief
A vulnerability in the Linux kernel's network traffic scheduling component could allow a local user to crash the system. The issue occurs when multiple processes attempt to modify or view network queue settings simultaneously, leading to a system instability or a complete halt. This affects the reliability of servers and workstations running impacted versions of the Linux operating system.
Technical details
A race condition exists in net/sched/sch_qfq.c within the Linux kernel's QFQ scheduler implementation. The vulnerability occurs because the 'qfq_aggregate' structure can be modified in 'qfq_change_agg' (via 'qfq_enqueue') while being concurrently accessed by other threads. This lack of proper synchronization can lead to a NULL pointer dereference in 'qfq_dump_class' or a use-after-free in 'qfq_delete_class'. An attacker with local access and the ability to manipulate network traffic control settings could exploit this to cause a denial of service (kernel panic). The fix involves moving 'qfq_destroy_class' into a critical section and implementing 'sch_tree_lock' protection during class dumping operations.
Affected products
- Linux Linux Kernel 3.8 to 5.4.297, 5.5 to 5.10.241, 5.11 to 5.15.190, 5.16 to 6.1.147, 6.2 to 6.6.100, 6.7 to 6.12.40, 6.13 to 6.15.8
Timeline
- 2025-07-10: other: Patch authored
- 2025-07-28: disclosed: CVE published
- 2025-12-23: advisory: NIST NVD analysis completed
References
- https://git.kernel.org/stable/c/466e10194ab81caa2ee6a332d33ba16bcceeeba6
- https://git.kernel.org/stable/c/5e28d5a3f774f118896aec17a3a20a9c5c9dfc64
- https://git.kernel.org/stable/c/a6d735100f602c830c16d69fb6d780eebd8c9ae1
- https://git.kernel.org/stable/c/aa7a22c4d678bf649fd3a1d27debec583563414d
- https://git.kernel.org/stable/c/c000a3a330d97f6c073ace5aa5faf94b9adb4b79
- https://git.kernel.org/stable/c/c6df794000147a3a02f79984aada4ce83f8d0a1e
- https://git.kernel.org/stable/c/d841aa5518508ab195b6781ad0d73ee378d713dd