huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2025-38396: kernel: fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass
Component: kernel
Severity: Moderate
CWE: CWE-266 (Incorrect Privilege Assignment)
CVSS v3: 6 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N)
Public date: 2025-07-25T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass

Export anon_inode_make_secure_inode() to allow KVM guest_memfd to create
anonymous inodes with proper security context. This replaces the current
pattern of calling alloc_anon_inode() followed by
inode_init_security_anon() for creating security context manually.

This change also fixes a security regression in secretmem where the
S_PRIVATE flag was not cleared after alloc_anon_inode(), causing
LSM/SELinux checks to be bypassed for secretmem file descriptors.

As guest_memfd currently resides in the KVM module, we need to export this
symbol for use outside the core kernel. In the future, guest_memfd might be
moved to core-mm, at which point the symbols no longer would have to be
exported. When/if that happens is still unclear.

Statement: A flaw in the anonymous inode creation logic allowed the memfd_secret mechanism to bypass LSM (e.g., SELinux) security checks due to incorrect handling of the S_PRIVATE flag. This could result in inodes being assigned without proper security labels, violating mandatory access control policies.

The vulnerability stems from calling alloc_anon_inode() without clearing the S_PRIVATE flag, which suppressed LSM enforcement on the resulting file descriptors. The patch replaces this logic with anon_inode_make_secure_inode(), ensuring consistent and secure inode labeling.

This bug could allow a privileged user or subsystem to create memory regions that bypass security controls, potentially undermining system-level isolation enforced by LSM frameworks.

Affected upstream versions: 6.0
Fixed upstream versions: 0, 6.1.146, 6.12.37, 6.15.6, 6.16, 6.6.97
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 66d29d757c968d2bee9124816da5d718eb352959
CVE-2025-38403: kernel: Kernel: Privilege escalation via uninitialized data in vmci transport packet
Component: kernel
Severity: Moderate
CWE: CWE-909 (Missing Initialization of Resource)
CVSS v3: 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Public date: 2025-07-25T00:00:00+00:00

A flaw was found in the Linux kernel's vsock/vmci component. A local attacker with low privileges could exploit a vulnerability where the vmci_transport_packet structure is not properly cleared during initialization. This can lead to the use of uninitialized data, potentially allowing for information disclosure, privilege escalation, or a denial of service (DoS).


Affected upstream versions: 3.9
Fixed upstream versions: 0, 5.10.240, 5.15.187, 5.4.296, 6.1.144, 6.12.37, 6.15.6, 6.16, 6.6.97
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 19c2cc01ff9a8031398a802676ffb0f4692dd95d
CVE-2025-38405: kernel: nvmet: fix memory leak of bio integrity
Component: kernel
Severity: Low
CWE: CWE-772 (Missing Release of Resource after Effective Lifetime)
CVSS v3: 3.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)
Public date: 2025-07-25T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

nvmet: fix memory leak of bio integrity

If nvmet receives commands with metadata there is a continuous memory
leak of kmalloc-128 slab or more precisely bio->bi_integrity.

Since commit bf4c89fc8797 ("block: don't call bio_uninit from bio_endio")
each user of bio_init has to use bio_uninit as well. Otherwise the bio
integrity is not getting free. Nvmet uses bio_init for inline bios.

Uninit the inline bio to complete deallocation of integrity in bio.


Affected upstream versions: 6.10.10 < 6.11, 6.11
Fixed upstream versions: 0, 6.11, 6.12.37, 6.15.6, 6.16
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 431e58d56fcb5ff1f9eb630724a922e0d2a941df
CVE-2025-38412: kernel: platform/x86: dell-wmi-sysman: Fix WMI data block retrieval in sysfs callbacks
Component: kernel
Severity: Moderate
CWE: CWE-129 (Improper Validation of Array Index)
CVSS v3: 6.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H)
Public date: 2025-07-25T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

platform/x86: dell-wmi-sysman: Fix WMI data block retrieval in sysfs callbacks

After retrieving WMI data blocks in sysfs callbacks, check for the
validity of them before dereferencing their content.

Statement: The vulnerability lies in the lack of validation on ACPI package structures retrieved through WMI sysfs callbacks in the dell-wmi-sysman driver. A local user with sysfs access can trigger a kernel crash or potentially leak memory by crafting malformed ACPI responses or racing access.

Enabled only for the latest version of the Red Hat Enterprise Linux 9 (and after).

Affected upstream versions: 5.11
Fixed upstream versions: 0, 5.15.187, 6.1.144, 6.12.37, 6.15.6, 6.16, 6.6.97
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 92c2d914b5337431d885597a79a3a3d9d55e80b7
CVE-2025-38415: kernel: Linux kernel: Memory corruption in Squashfs due to incorrect block size calculation
Component: kernel
Severity: Moderate
CWE: CWE-252 (Unchecked Return Value)
CVSS v3: 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Public date: 2025-07-25T00:00:00+00:00

A flaw was found in the Linux kernel's Squashfs filesystem. A local attacker can exploit this vulnerability by simultaneously mounting a Squashfs filesystem and issuing a specific input/output control (ioctl) command. This can lead to an incorrect block size calculation, causing a shift-out-of-bounds error. This memory corruption vulnerability can result in a denial of service or potentially lead to more severe system compromise.

Statement: This moderate impact flaw in the Linux kernel's Squashfs filesystem is present in Red Hat Enterprise Linux 7, 8, 9, and 10, which allows a local attacker to cause a denial of service or a potential system compromise by simultaneously mounting a Squashfs filesystem and issuing a specific ioctl command, leading to an incorrect block size calculation and a shift-out-of-bounds read issue due to an incorrect function return problem.

Affected upstream versions: 2.6.29
Fixed upstream versions: 0, 5.10.239, 5.15.186, 5.4.295, 6.1.142, 6.12.34, 6.15.3, 6.16, 6.6.94
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: db7096ea160e40d78c67fce52e7cc51bde049497
CVE-2025-38417: kernel: ice: fix eswitch code memory leak in reset scenario
Component: kernel
Severity: Moderate
CWE: CWE-392 (Missing Report of Error Condition)
CVSS v3: 4.7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-07-25T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ice: fix eswitch code memory leak in reset scenario

Add simple eswitch mode checker in attaching VF procedure and allocate
required port representor memory structures only in switchdev mode.
The reset flows triggers VF (if present) detach/attach procedure.
It might involve VF port representor(s) re-creation if the device is
configured is switchdev mode (not legacy one).
The memory was blindly allocated in current implementation,
regardless of the mode and not freed if in legacy mode.

Kmemeleak trace:
unreferenced object (percpu) 0x7e3bce5b888458 (size 40):
  comm "bash", pid 1784, jiffies 4295743894
  hex dump (first 32 bytes on cpu 45):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace (crc 0):
    pcpu_alloc_noprof+0x4c4/0x7c0
    ice_repr_create+0x66/0x130 [ice]
    ice_repr_create_vf+0x22/0x70 [ice]
    ice_eswitch_attach_vf+0x1b/0xa0 [ice]
    ice_reset_all_vfs+0x1dd/0x2f0 [ice]
    ice_pci_err_resume+0x3b/0xb0 [ice]
    pci_reset_function+0x8f/0x120
    reset_store+0x56/0xa0
    kernfs_fop_write_iter+0x120/0x1b0
    vfs_write+0x31c/0x430
    ksys_write+0x61/0xd0
    do_syscall_64+0x5b/0x180
    entry_SYSCALL_64_after_hwframe+0x76/0x7e

Testing hints (ethX is PF netdev):
- create at least one VF
    echo 1 > /sys/class/net/ethX/device/sriov_numvfs
- trigger the reset
    echo 1 > /sys/class/net/ethX/device/reset


Affected upstream versions: 6.12
Fixed upstream versions: 0, 6.12.35, 6.15.4, 6.16
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: d6715193de439b79f1d6a4c03593c7529239b545
CVE-2025-38425: kernel: Linux kernel (i2c Tegra): Information disclosure or denial of service via SMBUS block read with invalid length
Component: kernel
Severity: Moderate
CWE: CWE-130 (Improper Handling of Length Parameter Inconsistency)
CVSS v3: 6 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H)
Public date: 2025-07-25T00:00:00+00:00

A flaw was found in the Linux kernel's i2c Tegra driver. A local attacker with high privileges could exploit this vulnerability by providing a specially crafted SMBUS (System Management Bus) block read message with an invalid length. This could lead to an out-of-bounds read, potentially resulting in information disclosure or a denial of service (DoS) on the system.


Affected upstream versions: 5.18
Fixed upstream versions: 0, 6.1.142, 6.12.35, 6.15.4, 6.16, 6.6.95
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: c39d1a9ae4ad66afcecab124d7789722bfe909fa
CVE-2025-38438: kernel: ASoC: SOF: Intel: hda: Use devm_kstrdup() to avoid memleak.
Component: kernel
Severity: Low
CWE: CWE-772 (Missing Release of Resource after Effective Lifetime)
CVSS v3: 3.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)
Public date: 2025-07-25T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ASoC: SOF: Intel: hda: Use devm_kstrdup() to avoid memleak.

sof_pdata->tplg_filename can have address allocated by kstrdup()
and can be overwritten. Memory leak was detected with kmemleak:

unreferenced object 0xffff88812391ff60 (size 16):
  comm "kworker/4:1", pid 161, jiffies 4294802931
  hex dump (first 16 bytes):
    73 6f 66 2d 68 64 61 2d 67 65 6e 65 72 69 63 00  sof-hda-generic.
  backtrace (crc 4bf1675c):
    __kmalloc_node_track_caller_noprof+0x49c/0x6b0
    kstrdup+0x46/0xc0
    hda_machine_select.cold+0x1de/0x12cf [snd_sof_intel_hda_generic]
    sof_init_environment+0x16f/0xb50 [snd_sof]
    sof_probe_continue+0x45/0x7c0 [snd_sof]
    sof_probe_work+0x1e/0x40 [snd_sof]
    process_one_work+0x894/0x14b0
    worker_thread+0x5e5/0xfb0
    kthread+0x39d/0x760
    ret_from_fork+0x31/0x70
    ret_from_fork_asm+0x1a/0x30


Affected upstream versions: 5.2
Fixed upstream versions: 0, 6.12.39, 6.15.7, 6.16
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 68397fda2caa90e99a7c0bcb2cf604e42ef3b91f
CVE-2025-38441: kernel: netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto()
Component: kernel
Severity: Moderate
CWE: CWE-908 (Use of Uninitialized Resource)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-07-25T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto()

syzbot found a potential access to uninit-value in nf_flow_pppoe_proto()

Blamed commit forgot the Ethernet header.

BUG: KMSAN: uninit-value in nf_flow_offload_inet_hook+0x7e4/0x940 net/netfilter/nf_flow_table_inet.c:27
  nf_flow_offload_inet_hook+0x7e4/0x940 net/netfilter/nf_flow_table_inet.c:27
  nf_hook_entry_hookfn include/linux/netfilter.h:157 [inline]
  nf_hook_slow+0xe1/0x3d0 net/netfilter/core.c:623
  nf_hook_ingress include/linux/netfilter_netdev.h:34 [inline]
  nf_ingress net/core/dev.c:5742 [inline]
  __netif_receive_skb_core+0x4aff/0x70c0 net/core/dev.c:5837
  __netif_receive_skb_one_core net/core/dev.c:5975 [inline]
  __netif_receive_skb+0xcc/0xac0 net/core/dev.c:6090
  netif_receive_skb_internal net/core/dev.c:6176 [inline]
  netif_receive_skb+0x57/0x630 net/core/dev.c:6235
  tun_rx_batched+0x1df/0x980 drivers/net/tun.c:1485
  tun_get_user+0x4ee0/0x6b40 drivers/net/tun.c:1938
  tun_chr_write_iter+0x3e9/0x5c0 drivers/net/tun.c:1984
  new_sync_write fs/read_write.c:593 [inline]
  vfs_write+0xb4b/0x1580 fs/read_write.c:686
  ksys_write fs/read_write.c:738 [inline]
  __do_sys_write fs/read_write.c:749 [inline]


Affected upstream versions: 5.15.157 < 5.15.189, 6.1.88 < 6.1.146, 6.6.29 < 6.6.99, 6.8.8 < 6.9, 6.9
Fixed upstream versions: 0, 5.15.189, 6.1.146, 6.12.39, 6.15.7, 6.16, 6.6.99, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: a3aea97d55964e70a1e6426aa4cafdc036e8a2dd
CVE-2025-38453: kernel: io_uring/msg_ring: ensure io_kiocb freeing is deferred for RCU
Component: kernel
Severity: Moderate
CWE: CWE-825 (Expired Pointer Dereference)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2025-07-25T00:00:00+00:00

A use-after-free flaw was found in io_uring/msg_ring in the Linux Kernel. In this flaw io_kiocb freeing is deferred for RCU which can lead to a kernel information leak problem.


Affected upstream versions: 6.11
Fixed upstream versions: 0, 6.12.46, 6.15.7, 6.16
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 094ba14a471cc6c68078c7ad488539eaf32c2277
CVE-2025-38459: kernel: Linux kernel: Denial of Service in ATM CLIP module via infinite recursion
Component: kernel
Severity: Moderate
CWE: CWE-835 (Loop with Unreachable Exit Condition ('Infinite Loop'))
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2025-07-25T00:00:00+00:00

A flaw was found in the Linux kernel's Asynchronous Transfer Mode (ATM) Classical IP (CLIP) module. A local user can trigger an infinite recursive call in the `clip_push()` function by repeatedly calling the `ioctl(ATMARP_MKIP)` system call. This vulnerability occurs when the socket is closed, leading to stack exhaustion and a kernel crash, resulting in a Denial of Service (DoS).


Affected upstream versions: 2.6.12
Fixed upstream versions: 0, 5.10.240, 5.15.189, 5.4.296, 6.1.146, 6.12.39, 6.15.7, 6.16, 6.6.99
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: f493f31a63847624fd3199ac836a8bd8828e50e2
CVE-2025-38461: kernel: vsock: Fix transport_* TOCTOU
Component: kernel
Severity: Moderate
CWE: CWE-664 (Improper Control of a Resource Through its Lifetime)
CVSS v3: 7.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H)
Public date: 2025-07-25T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

vsock: Fix transport_* TOCTOU

Transport assignment may race with module unload. Protect new_transport
from becoming a stale pointer.

This also takes care of an insecure call in vsock_use_local_transport();
add a lockdep assert.

BUG: unable to handle page fault for address: fffffbfff8056000
Oops: Oops: 0000 [#1] SMP KASAN
RIP: 0010:vsock_assign_transport+0x366/0x600
Call Trace:
 vsock_connect+0x59c/0xc40
 __sys_connect+0xe8/0x100
 __x64_sys_connect+0x6e/0xc0
 do_syscall_64+0x92/0x1c0
 entry_SYSCALL_64_after_hwframe+0x4b/0x53

Statement: This patch addresses a race condition in the vsock core that could lead to a use-after-free or NULL pointer dereference when assigning transports during socket initialization.
The vulnerability stems from a lack of synchronization between transport selection and potential module unloading, leading to stale pointers being dereferenced.
A mutex now protects access to the transport selection logic, and reference counting ensures the module is retained during use.
The issue has low impact on confidentiality, but may cause a system crash, resulting in high availability impact.
Since the problem is reachable by unprivileged users via socket operations, Privileges Required = Low (for the CVSS).
While the issue is most clearly triggered during manual module unload, similar conditions can also arise from automatic module unloading, hotplug scripts, or asynchronous transport (de)registration in multi-threaded environments.

Affected upstream versions: 5.5
Fixed upstream versions: 0, 5.10.240, 5.15.189, 6.1.146, 6.12.39, 6.15.7, 6.16, 6.6.99
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 8667e8d0eb46bc54fdae30ba2f4786407d3d88eb
CVE-2025-38463: kernel: tcp: Correct signedness in skb remaining space calculation
Component: kernel
Severity: Moderate
CWE: CWE-681 (Incorrect Conversion between Numeric Types)
CVSS v3: 7.3 (CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
Public date: 2025-07-25T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

tcp: Correct signedness in skb remaining space calculation

Syzkaller reported a bug [1] where sk->sk_forward_alloc can overflow.

When we send data, if an skb exists at the tail of the write queue, the
kernel will attempt to append the new data to that skb. However, the code
that checks for available space in the skb is flawed:
'''
copy = size_goal - skb->len
'''

The types of the variables involved are:
'''
copy: ssize_t (s64 on 64-bit systems)
size_goal: int
skb->len: unsigned int
'''

Due to C's type promotion rules, the signed size_goal is converted to an
unsigned int to match skb->len before the subtraction. The result is an
unsigned int.

When this unsigned int result is then assigned to the s64 copy variable,
it is zero-extended, preserving its non-negative value. Consequently, copy
is always >= 0.

Assume we are sending 2GB of data and size_goal has been adjusted to a
value smaller than skb->len. The subtraction will result in copy holding a
very large positive integer. In the subsequent logic, this large value is
used to update sk->sk_forward_alloc, which can easily cause it to overflow.

The syzkaller reproducer uses TCP_REPAIR to reliably create this
condition. However, this can also occur in real-world scenarios. The
tcp_bound_to_half_wnd() function can also reduce size_goal to a small
value. This would cause the subsequent tcp_wmem_schedule() to set
sk->sk_forward_alloc to a value close to INT_MAX. Further memory
allocation requests would then cause sk_forward_alloc to wrap around and
become negative.

[1]: https://syzkaller.appspot.com/bug?extid=de6565462ab540f50e47

Statement: A signedness bug in the Linux TCP stack allowed incorrect calculation of remaining buffer space, leading to overflow of sk_forward_alloc.
This may result in memory corruption or kernel crashes when specific traffic patterns or repair mode (TCP_REPAIR) are used.
For the Red Hat Enterprise Linux the "Fixes" patch not applied yet, so not actual (the patch ID is 270a1c3de47e49dd2fc18f48e46b101e48050e78).
The issue can potentially be triggered remotely if more than 2GB of data is sent within a single TCP connection and several additional conditions are met, including a vulnerable kernel with support for MSG_SPLICE_PAGES and specific memory allocation behavior such as a reduced size_goal due to TCP window constraints.

Affected upstream versions: 6.5
Fixed upstream versions: 0, 6.12.39, 6.15.7, 6.16, 6.6.99
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 81373cd1d72d87c7d844d4454a526b8f53e72d00
CVE-2025-38471: kernel: tls: always refresh the queue when reading sock
Component: kernel
Severity: Important
CWE: CWE-416 (Use After Free)
CVSS v3: 7.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H)
Public date: 2025-07-28T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

tls: always refresh the queue when reading sock

After recent changes in net-next TCP compacts skbs much more
aggressively. This unearthed a bug in TLS where we may try
to operate on an old skb when checking if all skbs in the
queue have matching decrypt state and geometry.

    BUG: KASAN: slab-use-after-free in tls_strp_check_rcv+0x898/0x9a0 [tls]
    (net/tls/tls_strp.c:436 net/tls/tls_strp.c:530 net/tls/tls_strp.c:544)
    Read of size 4 at addr ffff888013085750 by task tls/13529

    CPU: 2 UID: 0 PID: 13529 Comm: tls Not tainted 6.16.0-rc5-virtme
    Call Trace:
     kasan_report+0xca/0x100
     tls_strp_check_rcv+0x898/0x9a0 [tls]
     tls_rx_rec_wait+0x2c9/0x8d0 [tls]
     tls_sw_recvmsg+0x40f/0x1aa0 [tls]
     inet_recvmsg+0x1c3/0x1f0

Always reload the queue, fast path is to have the record in the queue
when we wake, anyway (IOW the path going down "if !strp->stm.full_len").

Statement: This patch fixes a use-after-free bug in the kernel TLS (kTLS) implementation, where stale SKB pointers could be accessed due to aggressive TCP skb compaction.
The function tls_strp_read_sock() failed to reload the skb queue unconditionally, potentially leading to dereferencing freed memory in tls_strp_check_rcv().
This issue could be triggered remotely over a TCP+TLS connection and may result in kernel crashes or information disclosure.
While the bug requires precise timing and TCP skb compaction behavior, it may be remotely triggered through a TLS stream and can lead to kernel instability or data leakage from freed memory.
Although the underlying bug is a use-after-free read, it can lead to kernel panic on systems with KASAN, SLUB debug, panic_on_oops=1, or when the freed skb is reused and corrupted, potentially causing further memory violations or invalid state propagation in the TLS receive path.

Affected upstream versions: 6.0.6 < 6.1, 6.1
Fixed upstream versions: 0, 6.1, 6.1.147, 6.12.40, 6.15.8, 6.16, 6.6.100
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 730fed2ff5e259495712518e18d9f521f61972bb
CVE-2025-38477: kernel: net/sched: sch_qfq: Fix race condition on qfq_aggregate
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 7.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H)
Public date: 2025-07-28T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

net/sched: sch_qfq: Fix race condition on qfq_aggregate

A race condition can occur when 'agg' is modified in qfq_change_agg
(called during qfq_enqueue) while other threads access it
concurrently. For example, qfq_dump_class may trigger a NULL
dereference, and qfq_delete_class may cause a use-after-free.

This patch addresses the issue by:

1. Moved qfq_destroy_class into the critical section.

2. Added sch_tree_lock protection to qfq_dump_class and
qfq_dump_class_stats.

Statement: This patch fixes a race condition in the QFQ packet scheduler, where concurrent modification and access to cl->agg may result in a use-after-free or NULL pointer dereference.
The bug occurs when qfq_change_class() reassigns the agg pointer while other threads read it in qfq_dump_class() or qfq_delete_class().
The fix synchronizes access using sch_tree_lock() and reorders destruction logic to avoid concurrency issues.
This issue can be triggered locally by users with CAP_NET_ADMIN privileges and may lead to kernel crashes or denial-of-service.
Although the vulnerability involves a use-after-free, it only results in stale reads of deallocated memory, used in netlink reporting functions.
There is no write primitive, function pointer corruption, or kernel state modification, making privilege escalation infeasible in this case.

Affected upstream versions: 3.8
Fixed upstream versions: 0, 5.10.241, 5.15.190, 5.4.297, 6.1.147, 6.12.40, 6.15.8, 6.16, 6.6.100
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: aa7a22c4d678bf649fd3a1d27debec583563414d