Описание
Security update for the Linux Kernel (Live Patch 69 for SLE 12 SP5)
This update for the Linux Kernel 4.12.14-122_261 fixes one issue.
The following security issue was fixed:
- CVE-2025-38477: net/sched: sch_qfq: Fix race condition on qfq_aggregate (bsc#1247315).
Список пакетов
SUSE Linux Enterprise Live Patching 12 SP5
kgraft-patch-4_12_14-122_261-default-5-2.1
Ссылки
- Link for SUSE-SU-2025:03497-1
- E-Mail link for SUSE-SU-2025:03497-1
- SUSE Security Ratings
- SUSE Bug 1247315
- SUSE CVE CVE-2025-38477 page
Описание
In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_qfq: Fix race condition on qfq_aggregate A race condition can occur when 'agg' is modified in qfq_change_agg (called during qfq_enqueue) while other threads access it concurrently. For example, qfq_dump_class may trigger a NULL dereference, and qfq_delete_class may cause a use-after-free. This patch addresses the issue by: 1. Moved qfq_destroy_class into the critical section. 2. Added sch_tree_lock protection to qfq_dump_class and qfq_dump_class_stats.
Затронутые продукты
SUSE Linux Enterprise Live Patching 12 SP5:kgraft-patch-4_12_14-122_261-default-5-2.1
Ссылки
- CVE-2025-38477
- SUSE Bug 1247314
- SUSE Bug 1247315