High · published July 3, 2025
In the Linux kernel, the following vulnerability has been resolved:
net_sched: ets: fix a race in ets_qdisc_change()
Gerrard Tai reported a race condition in ETS, whenever SFQ perturb timer
fires at the wrong time.
The race is as follows:
CPU 0 CPU 1
[1]: lock root
[2]: qdisc_tree_flush_backlog()
[3]: unlock root
|
| [5]: lock root
| [6]: rehash
| [7]: qdisc_tree_reduce_backlog()
|
[4]: qdisc_put()
This can be abused to underflow a parent's qlen.
Calling qdisc_purge_queue() instead of qdisc_tree_flush_backlog()
should fix the race, because all packets will be purged from the qdisc
before releasing the lock.
| Product | Versions | Fixed in |
|---|---|---|
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | ≥ 5.4.213, < 5.5 | 5.5 |
| linux/linux_kernel | ≥ 5.10.142, < 5.10.239 | 5.10.239 |
| linux/linux_kernel | ≥ 5.15.66, < 5.15.186 | 5.15.186 |
| linux/linux_kernel | ≥ 5.19.8, < 6.0 | 6.0 |
| linux/linux_kernel | ≥ 6.0.1, < 6.1.142 | 6.1.142 |
| linux/linux_kernel | ≥ 6.2, < 6.6.94 | 6.6.94 |
| linux/linux_kernel | ≥ 6.7, < 6.12.34 | 6.12.34 |
| linux/linux_kernel | ≥ 6.13, < 6.15.3 | 6.15.3 |
| linux/linux_kernel | all versions | — |
| debian/debian_linux | all versions | — |