CVE-2025-38083

In the Linux kernel, the following vulnerability has been resolved:

net_sched: prio: fix a race in prio_tune()

Gerrard Tai reported a race condition in PRIO, whenever SFQ perturb timer fires at the wrong time.

The race is as follows:

CPU 0 CPU 1 [1]: lock root [2]: qdisc_tree_flush_backlog() [3]: unlock root | | [5]: lock root | [6]: rehash | [7]: qdisc_tree_reduce_backlog() | [4]: qdisc_put()

This can be abused to underflow a parent's qlen.

Calling qdisc_purge_queue() instead of qdisc_tree_flush_backlog() should fix the race, because all packets will be purged from the qdisc before releasing the lock.

This vulnerability is rated as Moderate impact for Red Hat Enterprise Linux because exploitation requires local access with network administrative privileges, alongside precise timing to trigger the race condition. On standard Red Hat deployments, unprivileged users cannot manipulate traffic control queuing disciplines unless granted specific capabilities or permitted via user namespaces. An attacker successfully triggering this flaw could induce queue length underflow, leading to kernel instability or a denial of service.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.