CVE-2025-37797

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-37797
In the Linux kernel, the following vulnerability has been resolved: net_sched: hfsc: Fix a UAF vulnerability in class handling This patch fixes a Use-After-Free vulnerability in the HFSC qdisc class handling. The issue occurs due to a time-of-check/time-of-use condition in hfsc_change_class() when working with certain child qdiscs like netem or codel. The vulnerability works as follows: 1. hfsc_change_class() checks if a class has packets (q.qlen != 0) 2. It then calls qdisc_peek_len(), which for certain qdiscs (e.g., codel, netem) might drop packets and empty the queue 3. The code continues assuming the queue is still non-empty, adding the class to vttree 4. This breaks HFSC scheduler assumptions that only non-empty classes are in vttree 5. Later, when the class is destroyed, this can lead to a Use-After-Free The fix adds a second queue length check after qdisc_peek_len() to verify the queue wasn't emptied.

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/20d584a33e480ae80d105f43e0e7b56784da41b9 Patch
https://git.kernel.org/stable/c/28b09a067831f7317c3841812276022d6c940677 Patch
https://git.kernel.org/stable/c/39b9095dd3b55d9b2743df038c32138efa34a9de Patch
https://git.kernel.org/stable/c/3aa852e3605000d5c47035c3fc3a986d14ccfa9f Patch
https://git.kernel.org/stable/c/3df275ef0a6ae181e8428a6589ef5d5231e58b5c Patch
https://git.kernel.org/stable/c/86cd4641c713455a4f1c8e54c370c598c2b1cee0 Patch
https://git.kernel.org/stable/c/bb583c88d23b72d8d16453d24856c99bd93dadf5 Patch
https://git.kernel.org/stable/c/fcc8ede663569c704fb00a702973bd6c00373283 Patch
https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html Mailing List Third Party Advisory
https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html Mailing List Third Party Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:4.14:-:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:4.14:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:4.14:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:4.14:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:4.14:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:4.14:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:4.14:rc7:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:4.14:rc8:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc3:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
History

06 Nov 2025, 20:48

Type Values Removed Values Added
First Time Linux
Debian
Debian debian Linux
Linux linux Kernel
CWE CWE-416
CPE cpe:2.3:o:linux:linux_kernel:4.14:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:4.14:rc8:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:4.14:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:4.14:rc7:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:4.14:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:4.14:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:4.14:-:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:4.14:rc2:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.8
References () https://git.kernel.org/stable/c/20d584a33e480ae80d105f43e0e7b56784da41b9 - () https://git.kernel.org/stable/c/20d584a33e480ae80d105f43e0e7b56784da41b9 - Patch
References () https://git.kernel.org/stable/c/28b09a067831f7317c3841812276022d6c940677 - () https://git.kernel.org/stable/c/28b09a067831f7317c3841812276022d6c940677 - Patch
References () https://git.kernel.org/stable/c/39b9095dd3b55d9b2743df038c32138efa34a9de - () https://git.kernel.org/stable/c/39b9095dd3b55d9b2743df038c32138efa34a9de - Patch
References () https://git.kernel.org/stable/c/3aa852e3605000d5c47035c3fc3a986d14ccfa9f - () https://git.kernel.org/stable/c/3aa852e3605000d5c47035c3fc3a986d14ccfa9f - Patch
References () https://git.kernel.org/stable/c/3df275ef0a6ae181e8428a6589ef5d5231e58b5c - () https://git.kernel.org/stable/c/3df275ef0a6ae181e8428a6589ef5d5231e58b5c - Patch
References () https://git.kernel.org/stable/c/86cd4641c713455a4f1c8e54c370c598c2b1cee0 - () https://git.kernel.org/stable/c/86cd4641c713455a4f1c8e54c370c598c2b1cee0 - Patch
References () https://git.kernel.org/stable/c/bb583c88d23b72d8d16453d24856c99bd93dadf5 - () https://git.kernel.org/stable/c/bb583c88d23b72d8d16453d24856c99bd93dadf5 - Patch
References () https://git.kernel.org/stable/c/fcc8ede663569c704fb00a702973bd6c00373283 - () https://git.kernel.org/stable/c/fcc8ede663569c704fb00a702973bd6c00373283 - Patch
References () https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html - () https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html - Mailing List, Third Party Advisory
References () https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html - () https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html - Mailing List, Third Party Advisory

03 Nov 2025, 20:18

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html -
  • () https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html -

05 May 2025, 20:54

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net_sched: hfsc: Se corrige una vulnerabilidad de UAF en la gestión de clases. Este parche corrige una vulnerabilidad de use-after-free en la gestión de clases de qdisc HFSC. El problema se produce debido a una condición de tiempo de comprobación/tiempo de uso en hfsc_change_class() al trabajar con ciertas qdiscs secundarias como netem o codel. La vulnerabilidad funciona de la siguiente manera: 1. hfsc_change_class() verifica si una clase tiene paquetes (q.qlen != 0) 2. Luego llama a qdisc_peek_len(), que para ciertos qdiscs (por ejemplo, codel, netem) puede descartar paquetes y vaciar la cola 3. El código continúa asumiendo que la cola todavía no está vacía, agregando la clase a vttree 4. Esto rompe las suposiciones del programador HFSC de que solo las clases no vacías están en vttree 5. Más tarde, cuando se destruye la clase, esto puede llevar a un Use-After-Free La solución agrega una segunda verificación de longitud de cola después de qdisc_peek_len() para verificar que la cola no se haya vaciado.

02 May 2025, 15:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-05-02 15:15

Updated : 2025-11-06 20:48

NVD link : CVE-2025-37797

Mitre link : CVE-2025-37797

CVE.ORG link : CVE-2025-37797

JSON object : View

Products Affected

debian

  • debian_linux

linux

  • linux_kernel
CWE
CWE-416

Use After Free