CVE-2025-38107

What it actually does

Race condition in ETS qdisc allowing qdisc_tree_flush_backlog and concurrent rehash operations to underflow a parent's qlen counter when the SFQ perturb timer fires during qdisc change.

Why it matters to the business

May cause network queue corruption leading to instability or denial-of-service on Linux systems handling traffic scheduling; widespread kernel exposure increases operational risk despite low exploit likelihood.

How an attack unfolds

Attacker arranges for the SFQ perturb timer to fire while ets_qdisc_change holds and releases the root lock, enabling CPU1 to perform rehash and reduce_backlog after CPU0 has flushed but before put, resulting in qlen underflow; listed threat actors targeting similar Linux kernel races may attempt to chain this for privilege escalation.

How to fix it

Update the Linux kernel to a version containing the fix that replaces qdisc_tree_flush_backlog with qdisc_purge_queue in ets_qdisc_change; for the listed affected package apply commit 627337d95bee7dd8d4690238a35fffd35072d1fa.

How to confirm the fix worked

Inspect kernel source for the corrected purge call in ets_qdisc_change, rebuild and boot test images, then exercise qdisc change paths under timer load to confirm qlen remains consistent.

Typical attack path

1. Gain local or network access to trigger ETS qdisc configuration changes
2. Force SFQ perturb timer activation at precise timing relative to qdisc_tree_flush_backlog
3. Induce concurrent root lock acquisition and qdisc_put sequence
4. Trigger qlen underflow in parent qdisc

How to detect it

Review kernel logs for qdisc qlen underflow warnings, unexpected backlog reductions, or ETS rehash events coinciding with timer firings; correlate with process activity from listed threat actors exploiting similar kernel issues.

What your security team should do

• Prioritize kernel updates on all exposed Linux hosts given the 481-day publication window
• Review network qdisc configurations for ETS usage
• Harden scheduling paths and monitor for queue anomalies