LiveActive security incident?Get immediate response
CVE Record

CVE-2025-38108: net_sched: red: fix a race in __red_change()

In the Linux kernel, the following vulnerability has been resolved: net_sched: red: fix a race in __red_change() Gerrard Tai reported a race condition in RED, whenever SFQ perturb timer fires at the wrong time. The race is as follows: CPU 0 CPU 1 [1]: lock root [2]: qdisc_tree_flush_backlog() [3]: unlock root | | [5]: lock root | [6]: rehash | [7]: qdisc_tree_reduce_backlog() | [4]: qdisc_put() This can be abused to underflow a parent's qlen. Calling qdisc_purge_queue() instead of qdisc_tree_flush_backlog() should fix the race, because all packets will be purged from the qdisc before releasing the lock.

HighCVSS 7.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A flaw in Linux network traffic scheduling can let a low-privileged local user trigger a timing race that corrupts queue accounting. The supplied rating indicates potentially serious system impact, but this is not described as a remote attack. Exposure depends on an affected kernel and the relevant RED/SFQ scheduling path.

Executive priority

Treat as a high-priority kernel update for affected multi-user systems, especially where untrusted local users can access the host and relevant scheduling is used. Prioritize by confirmed configuration and vendor package status. The supplied evidence does not support emergency remote-exploitation handling.

Technical view

During __red_change(), backlog flushing can release the root lock before queue teardown completes. An SFQ perturb timer may then rehash and reduce backlog concurrently, underflowing the parent qlen. The kernel fix uses qdisc_purge_queue() so packets are removed before the lock is released.

Likely exposure

Likely limited to Linux hosts running an affected kernel and exercising the RED/SFQ scheduler interaction. The supplied CVSS vector specifies local access, low privileges, low complexity, and no user interaction. The version data spans multiple 5.x and 6.x releases but is insufficient for precise distribution-package mapping.

Exploitation context

The record says the race can be abused, but provides no exploit procedure or evidence of attacks. It is not listed as KEV in the supplied bundle. Active exploitation should therefore not be claimed. The practical prerequisites beyond local low-privileged access and the affected scheduler path are not fully documented.

Researcher notes

No CWE, public proof of concept, active exploitation evidence, or complete distribution mapping is supplied. The description explicitly establishes a parent qlen underflow; broader confidentiality, integrity, and availability impact comes from the supplied CVSS metadata. Stable fixes exist across several kernel branches, so compare the deployed source or vendor package against the branch-appropriate commit.

Mitigation direction

  • Upgrade to a distribution kernel containing the applicable Linux stable fix for CVE-2025-38108.
  • Confirm the updated host has booted the fixed kernel; installing a package alone may leave the old kernel active.
  • Use distribution advisories to verify backport status rather than relying only on upstream version numbers.
  • If upgrades are delayed, request vendor-supported interim guidance for systems using RED and SFQ scheduling.

Validation and detection

  • Inventory running kernel versions across Linux systems, including hosts awaiting reboot after updates.
  • Identify systems using the RED and SFQ queue disciplines or otherwise exercising the described scheduler path.
  • Check distribution changelogs or kernel sources for the applicable referenced stable fix.
  • After maintenance, confirm each system is running the vendor-designated fixed kernel.
Prepared
Confidence
medium
Sources
12

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-38108 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
1ADP providers
11Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.8CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.8High
CVSS 3.1 vector shape for CVE-2025-38108Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux0c8d13ac96070000da33f394f45e9c19638483c5, 0c8d13ac96070000da33f394f45e9c19638483c5, 0c8d13ac96070000da33f394f45e9c19638483c5, 0c8d13ac96070000da33f394f45e9c19638483c5, 0c8d13ac96070000da33f394f45e9c19638483c5, 0c8d13ac96070000da33f394f45e9c19638483c5, 0c8d13ac96070000da33f394f45e9c19638483c5, 0c8d13ac96070000da33f394f45e9c19638483c5unaffected
LinuxLinux5.0, 0, 5.4.295, 5.10.239, 5.15.186, 6.1.142, 6.6.94, 6.12.34, 6.15.3, 6.16affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.