High 7.8Published Jul 3, 2025

CVE-2025-38108net_sched: red: fix a race in __red_change()

Updated under an hour ago (Oct 27, 2026, 5:20 PM ET)

Does this affect you?

It affects Linux and 2 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: net_sched: red: fix a race in __red_change() Gerrard Tai reported a race condition in RED, whenever SFQ perturb timer fires at the wrong time. The race is as follows: CPU 0 CPU 1 [1]: lock root [2]: qdisc_tree_flush_backlog() [3]: unlock root | | [5]: lock root | [6]: rehash | [7]: qdisc_tree_reduce_backlog() | [4]: qdisc_put() This can be abused to underflow a parent's qlen. Calling qdisc_purge_queue() instead of qdisc_tree_flush_backlog() should fix the race, because all packets will be purged from the qdisc before releasing the lock.

CVSS: 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 15, 2026
First seen by InfoSec Signals: Oct 15, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 0c8d13ac96070000da33f394f45e9c19638483c5 before 2790c4ec481be45a80948d059cd7c9a06bc37493; from 0c8d13ac96070000da33f394f45e9c19638483c5 before a1bf6a4e9264a685b0e642994031f9c5aad72414; from 0c8d13ac96070000da33f394f45e9c19638483c5 before 110a47efcf23438ff8d31dbd9c854fae2a48bf98; from 0c8d13ac96070000da33f394f45e9c19638483c5 before f569984417a4e12c67366e69bdcb752970de921d; from 0c8d13ac96070000da33f394f45e9c19638483c5 before 2a71924ca4af59ffc00f0444732b6cd54b153d0e; from 0c8d13ac96070000da33f394f45e9c19638483c5 before 4b755305b2b0618e857fdadb499365b5f2e478d1; from 0c8d13ac96070000da33f394f45e9c19638483c5 before 444ad445df5496a785705019268a8a84b84484bb; from 0c8d13ac96070000da33f394f45e9c19638483c5 before 85a3e0ede38450ea3053b8c45d28cf55208409b8	CNA record
linux linux_kernel linux:linux_kernel	from 5.0 before 5.4.295; from 5.5 before 5.10.239; from 5.11 before 5.15.186; from 5.16 before 6.1.142; from 6.2 before 6.6.94; from 6.7 before 6.12.34; from 6.13 before 6.15.3; 6.16	NVD
debian debian_linux debian:debian_linux	11.0	NVD

References

References

https://git.kernel.org/stable/c/2790c4ec481be45a80948d059cd7c9a06bc37493	patch
https://git.kernel.org/stable/c/a1bf6a4e9264a685b0e642994031f9c5aad72414	patch
https://git.kernel.org/stable/c/110a47efcf23438ff8d31dbd9c854fae2a48bf98	patch
https://git.kernel.org/stable/c/f569984417a4e12c67366e69bdcb752970de921d	patch
https://git.kernel.org/stable/c/2a71924ca4af59ffc00f0444732b6cd54b153d0e	patch
https://git.kernel.org/stable/c/4b755305b2b0618e857fdadb499365b5f2e478d1	patch
https://git.kernel.org/stable/c/444ad445df5496a785705019268a8a84b84484bb	patch
https://git.kernel.org/stable/c/85a3e0ede38450ea3053b8c45d28cf55208409b8	patch
https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html	mailing-list, third-party-advisory
https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html	mailing-list, third-party-advisory

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.