High 7.8Published Jul 28, 2025

CVE-2025-38477net/sched: sch_qfq: Fix race condition on qfq_aggregate

Updated under an hour ago (Oct 26, 2026, 1:00 PM ET)

Does this affect you?

It affects Linux and 3 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_qfq: Fix race condition on qfq_aggregate A race condition can occur when 'agg' is modified in qfq_change_agg (called during qfq_enqueue) while other threads access it concurrently. For example, qfq_dump_class may trigger a NULL dereference, and qfq_delete_class may cause a use-after-free. This patch addresses the issue by: 1. Moved qfq_destroy_class into the critical section. 2. Added sch_tree_lock protection to qfq_dump_class and qfq_dump_class_stats.

CVSS: 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Not yet received
Record last updated: Oct 14, 2026
First seen by InfoSec Signals: Oct 14, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 462dbc9101acd38e92eda93c0726857517a24bbd before aa7a22c4d678bf649fd3a1d27debec583563414d; from 462dbc9101acd38e92eda93c0726857517a24bbd before d841aa5518508ab195b6781ad0d73ee378d713dd; from 462dbc9101acd38e92eda93c0726857517a24bbd before c6df794000147a3a02f79984aada4ce83f8d0a1e; from 462dbc9101acd38e92eda93c0726857517a24bbd before 466e10194ab81caa2ee6a332d33ba16bcceeeba6; from 462dbc9101acd38e92eda93c0726857517a24bbd before fbe48f06e64134dfeafa89ad23387f66ebca3527; from 462dbc9101acd38e92eda93c0726857517a24bbd before a6d735100f602c830c16d69fb6d780eebd8c9ae1; from 462dbc9101acd38e92eda93c0726857517a24bbd before c000a3a330d97f6c073ace5aa5faf94b9adb4b79; 462dbc9101acd38e92eda93c0726857517a24bbd builds before 5e28d5a3f774f118896aec17a3a20a9c5c9dfc64	CNA record
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518_4_pn_dp_mfp (from the name)	from V3.1.5	CISA ADP
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518f_4_pn_dp_mfp (from the name)	from V3.1.5	CISA ADP
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP siemens:siplus_s7_1500_cpu_1518_4_pn_dp_mfp (from the name)	from V3.1.5	CISA ADP

References

References

https://git.kernel.org/stable/c/aa7a22c4d678bf649fd3a1d27debec583563414d
https://git.kernel.org/stable/c/d841aa5518508ab195b6781ad0d73ee378d713dd
https://git.kernel.org/stable/c/c6df794000147a3a02f79984aada4ce83f8d0a1e
https://git.kernel.org/stable/c/466e10194ab81caa2ee6a332d33ba16bcceeeba6
https://git.kernel.org/stable/c/fbe48f06e64134dfeafa89ad23387f66ebca3527
https://git.kernel.org/stable/c/a6d735100f602c830c16d69fb6d780eebd8c9ae1
https://git.kernel.org/stable/c/c000a3a330d97f6c073ace5aa5faf94b9adb4b79
https://git.kernel.org/stable/c/5e28d5a3f774f118896aec17a3a20a9c5c9dfc64

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.