PT-2025-24274 · Linux +3 · Linux Kernel +3
Savino
·
Published
2025-06-06
·
Updated
2025-08-04
·
CVE-2025-38001
None
**Name of the Vulnerable Software and Affected Versions:**
Linux kernel versions prior to the fix included in commit 141d34391abbb315d68556b7c67ad97885407547.
**Description:**
The Linux kernel contains a vulnerability in the `net sched` subsystem, specifically within the HFSC (Hierarchical Fair Queuing) scheduler. A use-after-free (UAF) condition can occur when HFSC is used in conjunction with NETEM (Network Emulator). The vulnerability arises because the patch intended to prevent double insertion into the eltree can be bypassed. Specifically, the check for existing class insertion is insufficient when using HFSC RSC, allowing a class to be inserted twice. This can lead to an infinite loop in `hfsc dequeue` under normal conditions, or, if TBF (Token Bucket Filter) is used as a root qdisc with a low rate, it can be exploited to cause a UAF.
**Recommendations:**
Update the Linux kernel to a version that includes the fix from commit 141d34391abbb315d68556b7c67ad97885407547. As a temporary workaround, consider disabling the `hfsc` queuing discipline or avoiding the use of HFSC with NETEM until a patched version is available.
Related Identifiers
Affected Products
References · 1861
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-37911 · Security Note
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22088 · Security Note
- https://bdu.fstec.ru/vul/2025-05648 · Security Note
- https://ubuntu.com/security/CVE-2024-58058 · Vendor Advisory
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22047 · Security Note
- https://ubuntu.com/security/CVE-2025-22078 · Vendor Advisory
- https://ubuntu.com/security/CVE-2025-21956 · Vendor Advisory
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22001 · Security Note
- https://ubuntu.com/security/CVE-2025-37785 · Vendor Advisory
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21719 · Security Note
- https://ubuntu.com/security/CVE-2025-37758 · Vendor Advisory
- https://ubuntu.com/security/CVE-2024-58002 · Vendor Advisory
- https://ubuntu.com/security/CVE-2025-21699 · Vendor Advisory
- https://ubuntu.com/security/CVE-2025-37829 · Vendor Advisory
- https://ubuntu.com/security/CVE-2025-23142 · Vendor Advisory