CVE-2025-38477

What it actually does

Race condition in qfq_change_agg during qfq_enqueue allows concurrent modification of 'agg' structure, enabling NULL dereference in qfq_dump_class and use-after-free in qfq_delete_class when unprotected by sch_tree_lock.

Why it matters to the business

Local attackers may trigger kernel instability or crashes in network traffic scheduling, disrupting services on affected Linux systems; low EPSS and non-KEV status limit widespread risk but kernel exposure still requires attention given ecosystem prevalence.

How an attack unfolds

Attacker with local privileges triggers qfq_enqueue to modify aggregates while qfq_dump_class or qfq_delete_class runs concurrently without lock protection, leading to memory corruption; referenced campaigns by espionage and financially motivated actors highlight potential interest in similar kernel races.

How to fix it

Apply kernel patch that moves qfq_destroy_class into the critical section and adds sch_tree_lock protection to qfq_dump_class and qfq_dump_class_stats; upgrade to fixed imagemagick/imagemagick (GIT) commit 83b6fc338ae1d38602eb5f6b307393adc3a0e1a7 where applicable.

How to confirm the fix worked

Confirm presence of sch_tree_lock around aggregate access in qfq_dump_class and qfq_dump_class_stats; test concurrent enqueue/dump/delete operations post-patch to verify absence of crashes.

Typical attack path

1. Obtain local user access on target Linux system
2. Configure or manipulate qfq scheduler classes to invoke qfq_change_agg
3. Trigger concurrent class dump or delete operations
4. Exploit resulting NULL dereference or use-after-free for denial of service

How to detect it

Review kernel logs for oops/panic messages involving qfq_aggregate, qfq_dump_class or qfq_delete_class; correlate with local processes performing class configuration changes around crash timestamps.

What your security team should do

• Prioritize kernel updates on all exposed Linux hosts within 30 days
• Restrict untrusted local access and scheduler configuration privileges
• Monitor EPSS trend and threat actor activity for escalation signals