CVE-2025-38108

What it actually does

Race condition in RED qdisc __red_change allows concurrent SFQ perturb timer rehash and qdisc_tree_flush_backlog/qdisc_put operations to underflow a parent qdisc qlen counter.

Why it matters to the business

Linux systems performing network traffic shaping may experience queue accounting corruption leading to instability, dropped traffic, or denial of service in production network environments.

How an attack unfolds

An attacker with ability to configure SFQ and RED qdiscs triggers the perturb timer to fire between root lock release after qdisc_tree_flush_backlog and subsequent qdisc_put, allowing rehash plus qdisc_tree_reduce_backlog to underflow qlen; listed threat actors have used similar kernel races for privilege escalation.

How to fix it

Upgrade to Linux kernel commit 2790c4ec481be45a80948d059cd7c9a06bc37493 or later stable releases containing the qdisc_purge_queue fix; for cloudprober-fips update to 0.14.0-r2.

How to confirm the fix worked

Confirm kernel source contains the qdisc_purge_queue replacement in __red_change; test by exercising SFQ perturb timer concurrently with RED reconfiguration and verify qlen remains non-negative.

Typical attack path

1. Obtain local access or container escape on affected Linux kernel
2. Configure nested SFQ and RED qdiscs on a network interface
3. Time or induce perturb timer fire during qdisc change operations
4. Trigger underflow of parent qlen via concurrent rehash and purge paths
5. Abuse resulting queue accounting corruption for denial of service or further exploitation

How to detect it

Review kernel logs and netlink audit records for concurrent qdisc configuration changes involving RED and SFQ; look for unexpected qlen underflow warnings or scheduler anomalies around perturb timer events.

What your security team should do

• Prioritize kernel updates on all systems using RED or SFQ qdiscs within 30 days
• Audit network configurations for custom qdisc hierarchies that may expose the race
• Monitor EPSS trend and similar kernel privilege-escalation campaigns for increased exploitation likelihood
• Apply compensating controls such as disabling perturb timers where operationally feasible until patched