CVE-2025-38477: debian linux — Fix

Description

In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_qfq: Fix race condition on qfq_aggregate A race condition can occur when 'agg' is modified in qfq_change_agg (called during qfq_enqueue) while other threads access it concurrently. For example, qfq_dump_class may trigger a NULL dereference, and qfq_delete_class may cause a use-after-free. This patch addresses the issue by: 1. Moved qfq_destroy_class into the critical section. 2. Added sch_tree_lock protection to qfq_dump_class and qfq_dump_class_stats.

Is your site exposed to CVE-2025-38477?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

4.7

MEDIUM

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness Type (CWE)

CWE-362 CWE-362

Affected Products

Vendor	Product	Versions
linux	linux_kernel	3.8 — 5.4.297
linux	linux_kernel	5.5 — 5.10.241
linux	linux_kernel	5.11 — 5.15.190
linux	linux_kernel	5.16 — 6.1.147
linux	linux_kernel	6.2 — 6.6.100
linux	linux_kernel	6.7 — 6.12.40
linux	linux_kernel	6.13 — 6.15.8
linux	linux_kernel	All
linux	linux_kernel	All
linux	linux_kernel	All
linux	linux_kernel	All
linux	linux_kernel	All
linux	linux_kernel	All
debian	debian_linux	All

References

Advisories & Patches

https://git.kernel.org/stable/c/466e10194ab81caa2ee6a332d33ba16bcceeeba6 https://git.kernel.org/stable/c/5e28d5a3f774f118896aec17a3a20a9c5c9dfc64 https://git.kernel.org/stable/c/a6d735100f602c830c16d69fb6d780eebd8c9ae1 https://git.kernel.org/stable/c/aa7a22c4d678bf649fd3a1d27debec583563414d https://git.kernel.org/stable/c/c000a3a330d97f6c073ace5aa5faf94b9adb4b79 https://git.kernel.org/stable/c/c6df794000147a3a02f79984aada4ce83f8d0a1e https://git.kernel.org/stable/c/d841aa5518508ab195b6781ad0d73ee378d713dd https://git.kernel.org/stable/c/fbe48f06e64134dfeafa89ad23387f66ebca3527

Other References

https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html https://cert-portal.siemens.com/productcert/html/ssa-082556.html

Frequently Asked Questions

What is CVE-2025-38477? +

In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_qfq: Fix race condition on qfq_aggregate A race condition can occur when 'agg' is modified in qfq_change_agg (called during qfq_enqueue) while other threads access it concurrently. For example, qfq_dump_class may trigger a NULL dereference, and qfq_delete_class may cause a use-after-free. This patch addresses the issue by: 1. Moved qfq_destroy_class into the critical section. 2. Added sch_tree_lock protection to qfq_dump_class and qfq_dump_class_stats. It has a CVSS v3.1 base score of 4.7 (MEDIUM).

How severe is CVE-2025-38477? +

CVE-2025-38477 has a CVSS v3.1 score of 4.7 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance.

What products are affected by CVE-2025-38477? +

CVE-2025-38477 affects products from debian, linux, specifically: debian_linux, linux_kernel. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2025-38477? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-41458

OwnTone Server versions 28.4 through 29.0 contain a race condition vulnerability in the DAAP login handler that allows unauthenticated attackers …

CVE-2025-13036

An authentication bypass security issue exists within FactoryTalk Historian Site Edition. By continually sending requests to the login endpoint, an …

CVE-2025-0372

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in HYPR Passwordless on Windows allows Privilege Escalation.This issue …

CVE-2025-59052

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Angular uses a …

CVE-2024-47534

go-tuf is a Go implementation of The Update Framework (TUF). The go-tuf client inconsistently traces the delegations. For example, if …

CVE-2025-64118

node-tar is a Tar for Node.js. In 7.5.1, using .t (aka .list) with { sync: true } to read tar …

CVE-2025-38477