CVE-2025-38108

In the Linux kernel, the following vulnerability has been resolved:

net_sched: red: fix a race in __red_change()

Gerrard Tai reported a race condition in RED, whenever SFQ perturb timer fires at the wrong time.

The race is as follows:

CPU 0 CPU 1 [1]: lock root [2]: qdisc_tree_flush_backlog() [3]: unlock root | | [5]: lock root | [6]: rehash | [7]: qdisc_tree_reduce_backlog() | [4]: qdisc_put()

This can be abused to underflow a parent's qlen.

Calling qdisc_purge_queue() instead of qdisc_tree_flush_backlog() should fix the race, because all packets will be purged from the qdisc before releasing the lock.

This vulnerability is rated as Moderate impact for Red Hat Enterprise Linux because exploitation requires local access with administrative privileges (specifically CAP_NET_ADMIN) or the ability to create unprivileged user namespaces to configure network traffic control. On typical installations, the Random Early Detection (RED) queueing discipline is not configured by default and is only loaded when explicitly specified by a system administrator. While an underflow in queue length tracking can lead to denial of service or unexpected kernel memory states, the high privileges or specific namespace configuration required significantly limit exposure.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.