LiveActive security incident?Get immediate response
CVE Record

CVE-2025-38083: net_sched: prio: fix a race in prio_tune()

In the Linux kernel, the following vulnerability has been resolved: net_sched: prio: fix a race in prio_tune() Gerrard Tai reported a race condition in PRIO, whenever SFQ perturb timer fires at the wrong time. The race is as follows: CPU 0 CPU 1 [1]: lock root [2]: qdisc_tree_flush_backlog() [3]: unlock root | | [5]: lock root | [6]: rehash | [7]: qdisc_tree_reduce_backlog() | [4]: qdisc_put() This can be abused to underflow a parent's qlen. Calling qdisc_purge_queue() instead of qdisc_tree_flush_backlog() should fix the race, because all packets will be purged from the qdisc before releasing the lock.

HighCVSS 7.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A local, low-privileged Linux user may trigger a timing flaw in network traffic scheduling and corrupt queue accounting. The CVSS assessment indicates potentially severe confidentiality, integrity, and availability consequences, but the supplied evidence does not establish practical exploitation or attacks in the wild.

Executive priority

Prioritize remediation in the normal high-severity patch cycle, accelerating internet-facing multi-tenant, shared-hosting, and other untrusted-user systems. This is not evidenced as a remote or actively exploited emergency, but its local low-privilege requirements and high CVSS impact justify prompt inventory and patch verification.

Technical view

A race in prio_tune() occurs when PRIO queue reconfiguration overlaps an SFQ perturbation timer. Releasing the root lock before qdisc_put() permits concurrent rehash and backlog reduction, potentially underflowing a parent qdisc's qlen. The kernel fix purges queued packets before releasing the lock.

Likely exposure

Exposure is limited to Linux systems running an affected or unpatched kernel where the relevant PRIO and SFQ traffic-control paths are reachable by a local, low-privileged user. The supplied version data is ambiguous, so distribution backports and exact kernel builds require verification.

Exploitation context

The CVSS vector describes local access, low privileges, low complexity, and no user interaction. CISA KEV status is false in the supplied bundle, and no cited source establishes active exploitation or a public working exploit. Treat the stated confidentiality, integrity, and availability impact as potential rather than confirmed operational impact.

Researcher notes

The essential invariant is that queued packets must be purged while the qdisc root lock remains held. The correction replaces qdisc_tree_flush_backlog() with qdisc_purge_queue(), preventing concurrent SFQ rehash and backlog reduction from operating on inconsistent accounting. The sources do not identify a CWE or demonstrate reliable security impact beyond the qlen underflow.

Mitigation direction

  • Apply the appropriate kernel or distribution security update containing the upstream fix.
  • Check Linux vendor guidance because distribution kernels may backport fixes without changing their base version.
  • Prioritize multi-user systems where untrusted local users can reach traffic-control functionality.
  • Restrict unnecessary local access and traffic-control privileges until patched.

Validation and detection

  • Record each system's exact running kernel build and distribution package revision.
  • Confirm remediation through the distribution advisory or inclusion of the applicable stable-kernel commit.
  • Identify hosts using PRIO with SFQ-based traffic-control configurations.
  • After updating, verify the patched kernel is running following any required reboot.
Prepared
Confidence
medium
Sources
12

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-38083 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
2ADP providers
12Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.8CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.8High
CVSS 3.1 vector shape for CVE-2025-38083Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container
siemens-SADPADP container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux7b8e0b6e659983154c8d7e756cdb833d89a3d4d7, 7b8e0b6e659983154c8d7e756cdb833d89a3d4d7, 7b8e0b6e659983154c8d7e756cdb833d89a3d4d7, 7b8e0b6e659983154c8d7e756cdb833d89a3d4d7, 7b8e0b6e659983154c8d7e756cdb833d89a3d4d7, 7b8e0b6e659983154c8d7e756cdb833d89a3d4d7, 7b8e0b6e659983154c8d7e756cdb833d89a3d4d7, 7b8e0b6e659983154c8d7e756cdb833d89a3d4d7unaffected
LinuxLinux5.0, 0, 5.4.295, 5.10.239, 5.15.186, 6.1.142, 6.6.94, 6.12.34, 6.15.3, 6.16affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.