CVE-2025-38107

A flaw was found in the Linux kernel's network scheduler component. A race condition in the ets_qdisc_change() function allows a local attacker with low privileges to exploit a timing issue. This can lead to an underflow of a queue's length, resulting in a denial of service (DoS) and potentially compromising data confidentiality and integrity.

A moderate-severity vulnerability was found in the Linux kernel's ETS network scheduler in Red Hat Enterprise Linux 8, 9, and 10 and Red Hat In-Vehicle OS. A race condition in the ets_qdisc_change() function in net/sched/sch_ets.c, which can be triggered when an SFQ perturb timer fires while a qdisc's backlog is being flushed, allows a local attacker with low privileges to underflow a parent qdisc's queue length, resulting in a denial of service, with potential impact on data confidentiality and integrity. Red Hat Enterprise Linux 6 and 7 are not affected because the vulnerable code is not present in those releases. Red Hat rates this flaw Moderate with a CVSS score of 6.3 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H), lower than the NIST rating of High (7.0), because exploitation requires local access with low privileges and successful timing of a narrow race window, which reduces the likelihood of a successful attack. Fixes for the affected Red Hat Enterprise Linux and Red Hat In-Vehicle OS streams are currently deferred to a future update; the residual risk is that a local attacker able to time the race could cause a denial of service.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.