CVE-2025-38477

A flaw was found in the Linux kernel's Quick Fair Queueing (QFQ) network packet scheduler. A local user with network administration privileges could exploit this vulnerability to cause a Denial of Service (DoS) by crashing the system. The issue is caused by a race condition when network scheduling classes are modified concurrently with status reporting operations, leading to improper memory access.

This patch fixes a race condition in the QFQ packet scheduler, where concurrent modification and access to cl->agg may result in a use-after-free or NULL pointer dereference. The bug occurs when qfq_change_class() reassigns the agg pointer while other threads read it in qfq_dump_class() or qfq_delete_class(). The fix synchronizes access using sch_tree_lock() and reorders destruction logic to avoid concurrency issues. This issue can be triggered locally by users with CAP_NET_ADMIN privileges and may lead to kernel crashes or denial-of-service. Although the vulnerability involves a use-after-free, it only results in stale reads of deallocated memory, used in netlink reporting functions. There is no write primitive, function pointer corruption, or kernel state modification, making privilege escalation infeasible in this case.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent module sch_qfq from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.