CVE-2025-38083

MediumCVSS 4.7/10Last modified Oct 15, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

net_sched: prio: fix a race in prio_tune()

Gerrard Tai reported a race condition in PRIO, whenever SFQ perturb timer fires at the wrong time.

The race is as follows:

CPU 0 CPU 1 [1]: lock root [2]: qdisc_tree_flush_backlog() [3]: unlock root | | [5]: lock root | [6]: rehash | [7]: qdisc_tree_reduce_backlog() | [4]: qdisc_put()

This can be abused to underflow a parent's qlen.

Calling qdisc_purge_queue() instead of qdisc_tree_flush_backlog() should fix the race, because all packets will be purged from the qdisc before releasing the lock.

Metrics

CVSS 3.1 4.7/10CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-362

Affected software

VendorProductVersions
LinuxLinux>= 7b8e0b6e659983154c8d7e756cdb833d89a3d4d7, < 53d11560e957d53ee87a0653d258038ce12361b7; >= 7b8e0b6e659983154c8d7e756cdb833d89a3d4d7, < 4483d8b9127591c60c4eb789d6cab953bc4522a9; >= 7b8e0b6e659983154c8d7e756cdb833d89a3d4d7, < 20f68e6a9e41693cb0e55e5b9ebbcb40983a4b8f; >= 7b8e0b6e659983154c8d7e756cdb833d89a3d4d7, < 3aaa7c01cf19d9b9bb64b88b65c3a6fd05da2eb4; >= 7b8e0b6e659983154c8d7e756cdb833d89a3d4d7, < 46c15c9d0f65c9ba857d63f53264f4b17e8a715f; >= 7b8e0b6e659983154c8d7e756cdb833d89a3d4d7, < e3f6745006dc9423d2b065b90f191cfa11b1b584; >= 7b8e0b6e659983154c8d7e756cdb833d89a3d4d7, < 93f9eeb678d4c9c1abf720b3615fa8299a490845; >= 7b8e0b6e659983154c8d7e756cdb833d89a3d4d7, < d35acc1be3480505b5931f17e4ea9b7617fea4d3
LinuxLinux5.0
SiemensSIMATIC S7-1500 CPU 1518-4 PN/DP MFP>= V3.1.5, < *
SiemensSIMATIC S7-1500 CPU 1518-4 PN/DP MFP>= V3.1.5, < *
SiemensSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP>= V3.1.5, < *
SiemensSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP>= V3.1.5, < *
SiemensSIPLUS S7-1500 CPU 1518-4 PN/DP MFP>= V3.1.5, < *

References

Timeline

Published
Jun 20, 2025
Last modified
Oct 15, 2026
NVD status
Modified

Related CVEs from 2025

CVE-2025-380845.5In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: unshare page tables during VMA split, not before CurrentlyCVE-2025-380854.7In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race huge_pmd_unshare()CVE-2025-380865.5In the Linux kernel, the following vulnerability has been resolved: net: ch9200: fix uninitialised access during mii_nway_restart In mii_nCVE-2025-380877.8In the Linux kernel, the following vulnerability has been resolved: net/sched: fix use-after-free in taprio_dev_notifier Since taprio’s taCVE-2025-380887.1In the Linux kernel, the following vulnerability has been resolved: powerpc/powernv/memtrace: Fix out of bounds issue in memtrace mmap memCVE-2025-380895.5In the Linux kernel, the following vulnerability has been resolved: sunrpc: handle SVC_GARBAGE during svc auth processing as auth error tiCVE-2025-38097.2The Debug Log Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the auto-refresh debug log in all versions up toCVE-2025-380905.5In the Linux kernel, the following vulnerability has been resolved: drivers/rapidio/rio_cm.c: prevent possible heap overwrite In riocm_cdCVE-2025-380917.8In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: check stream id dml21 wrapper to get plane_id [Why & CVE-2025-380925.5In the Linux kernel, the following vulnerability has been resolved: ksmbd: use list_first_entry_or_null for opinfo_get_list() The list_firCVE-2025-380935.5In the Linux kernel, the following vulnerability has been resolved: arm64: dts: qcom: x1e80100: Add GPU cooling Unlike the CPU, the GPU doCVE-2025-380945.5In the Linux kernel, the following vulnerability has been resolved: net: cadence: macb: Fix a possible deadlock in macb_halt_tx. There is
CVE-2025-38083: Medium severity, CVSS 4.7 | Vulnix