CVE-2025-38477 in Linux
Summary
by MITRE • 07/28/2025
In the Linux kernel, the following vulnerability has been resolved:
net/sched: sch_qfq: Fix race condition on qfq_aggregate
A race condition can occur when 'agg' is modified in qfq_change_agg (called during qfq_enqueue) while other threads access it concurrently. For example, qfq_dump_class may trigger a NULL dereference, and qfq_delete_class may cause a use-after-free.
This patch addresses the issue by:
1. Moved qfq_destroy_class into the critical section.
2. Added sch_tree_lock protection to qfq_dump_class and qfq_dump_class_stats.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/01/2026
The vulnerability CVE-2025-38477 represents a critical race condition within the Linux kernel's Quality of Service queuing framework, specifically in the qfq (Quick Fair Queuing) scheduler module. This flaw exists in the network scheduling subsystem where multiple threads can simultaneously access and modify shared data structures without proper synchronization mechanisms. The qfq scheduler is designed to provide fair bandwidth allocation among network flows, making it a critical component in network traffic management and quality of service implementations. The race condition manifests when the qfq_aggregate structure is modified during qfq_change_agg operations, which are invoked during packet enqueue processes, while other threads concurrently attempt to access the same data structure.
The technical implementation of this vulnerability stems from insufficient locking mechanisms in the qfq scheduler's multi-threaded environment. When qfq_change_agg executes during qfq_enqueue operations, it modifies the agg parameter that represents aggregate flow information, creating a window where other concurrent threads may access stale or invalid memory references. This particular race condition can lead to two distinct but serious consequences that demonstrate the fundamental nature of the flaw. The first scenario involves qfq_dump_class triggering a NULL dereference when it attempts to access the agg structure after it has been modified or freed by another thread. The second scenario occurs with qfq_delete_class causing a use-after-free condition when memory that was already freed is accessed, potentially leading to system instability or privilege escalation.
The operational impact of this vulnerability extends beyond simple system crashes, affecting the reliability and security posture of Linux systems that utilize advanced network scheduling features. Network administrators and system operators using kernel versions containing this flaw face potential denial of service conditions where network services may become unavailable due to kernel panics or memory corruption. The vulnerability particularly affects systems running network-intensive workloads such as high-performance computing clusters, network appliances, and servers handling substantial traffic loads where qfq scheduling is actively employed. From a cybersecurity perspective, this race condition could potentially be exploited by malicious actors to cause system instability or in extreme cases, achieve privilege escalation depending on the specific system configuration and attack vectors available. The vulnerability aligns with CWE-362, which describes race conditions in concurrent programming, and represents a classic example of improper locking mechanisms in kernel space.
The patch implementation addresses the vulnerability by implementing proper synchronization measures through the addition of sch_tree_lock protection around critical functions. The solution involves moving qfq_destroy_class into the critical section to ensure that destruction operations occur atomically with modification operations, preventing the scenario where a thread might access freed memory. Additionally, the patch adds sch_tree_lock protection to qfq_dump_class and qfq_dump_class_stats functions, ensuring that these data access operations occur within proper synchronization boundaries. This approach follows established best practices for kernel-level concurrency control and aligns with ATT&CK technique T1068, which involves exploiting local privilege escalation through kernel vulnerabilities. The mitigation strategy demonstrates the importance of proper locking mechanisms in kernel space where multiple threads can access shared resources simultaneously, and it reflects the broader security principle that concurrent access to shared data structures must be carefully controlled to prevent memory safety violations and maintain system integrity. The fix ensures that all operations modifying or accessing the qfq_aggregate structure occur within appropriate synchronization contexts, eliminating the race condition window that previously enabled both NULL dereference and use-after-free scenarios.