PT-2025-24274 · Linux+7 · Linux Kernel+7

Savino

·

Published

2025-05-22

·

Updated

2026-02-22

·

CVE-2025-38001

CVSS v2.0
5.7
VectorAV:L/AC:L/Au:S/C:P/I:P/A:C
Name of the Vulnerable Software and Affected Versions
Linux kernel versions prior to the fix included in commit 141d34391abbb315d68556b7c67ad97885407547.
Description
The Linux kernel contains a vulnerability in the 
net sched
subsystem, specifically within the HFSC (Hierarchical Fair Queuing) scheduler. A use-after-free (UAF) condition can occur when HFSC is used in conjunction with NETEM (Network Emulator). The vulnerability arises because the patch intended to prevent double insertion into the eltree can be bypassed. Specifically, the check for existing class insertion is insufficient when using HFSC RSC, allowing a class to be inserted twice. This can lead to an infinite loop in 
hfsc dequeue
under normal conditions, or, if TBF (Token Bucket Filter) is used as a root qdisc with a low rate, it can be exploited to cause a UAF.
Recommendations
Update the Linux kernel to a version that includes the fix from commit 141d34391abbb315d68556b7c67ad97885407547. As a temporary workaround, consider disabling the 
hfsc
queuing discipline or avoiding the use of HFSC with NETEM until a patched version is available.

Exploit

Fix

RCE

LPE

Infinite Loop

Weakness Enumeration

CWE-835

Related Identifiers

ALSA-2025_15008
ALSA-2025_15009
ALSA-2025_15011
ALSA-2025_15785
ALSA-2025_15786
ALSA-2025_16372
ALSA-2025_16373
BDU:2025-12349
CESA-2025_16582
CVE-2025-38001
DLA-4327-1
DLA-4328-1
DSA-5973-1
ECHO-8B54-DB62-922A
OESA-2025-2077
OESA-2025-2078
OESA-2025-2079
OESA-2025-2081
OESA-2025-2082
RHSA-2025:12209
RHSA-2025:12311
RHSA-2025:14511
RHSA-2025:14692
RHSA-2025:14742
RHSA-2025:14744
SUSE-SU-2025:02249-1
SUSE-SU-2025:02264-1
SUSE-SU-2025:02308-1
SUSE-SU-2025:02537-1
SUSE-SU-2025:02538-1
SUSE-SU-2025:02923-1
SUSE-SU-2025:03097-1
SUSE-SU-2025:03100-1
SUSE-SU-2025:03104-1
SUSE-SU-2025:03106-1
SUSE-SU-2025:03108-1
SUSE-SU-2025:03109-1
SUSE-SU-2025:03111-1
SUSE-SU-2025:03124-1
SUSE-SU-2025:03126-1
SUSE-SU-2025:03129-1
SUSE-SU-2025:03130-1
SUSE-SU-2025:03156-1
SUSE-SU-2025:03160-1
SUSE-SU-2025:03179-1
SUSE-SU-2025:03180-1
SUSE-SU-2025:03181-1
SUSE-SU-2025:03182-1
SUSE-SU-2025:03184-1
SUSE-SU-2025:03185-1
SUSE-SU-2025:03186-1
SUSE-SU-2025:03190-1
SUSE-SU-2025:03191-1
SUSE-SU-2025:03194-1
SUSE-SU-2025:03195-1
SUSE-SU-2025:03215-1
SUSE-SU-2025_02249-1
SUSE-SU-2025_02254-1
SUSE-SU-2025_02264-1
SUSE-SU-2025_02307-1
SUSE-SU-2025_02308-1
SUSE-SU-2025_02333-1
SUSE-SU-2025_02335-1
SUSE-SU-2025_02537-1
SUSE-SU-2025_02538-1
USN-7608-1
USN-7608-2
USN-7608-3
USN-7608-4
USN-7608-5
USN-7608-6
USN-7608-7
USN-7609-1
USN-7609-2
USN-7609-3
USN-7609-4
USN-7609-5
USN-7610-1
USN-7610-2
USN-7610-3
USN-7611-1
USN-7611-2
USN-7611-3
USN-7611-4
USN-7618-1
USN-7628-1
USN-7653-1
USN-7655-1
USN-7665-2
USN-7671-1
USN-7671-2
USN-7671-3
USN-7686-1
USN-7712-1
USN-7712-2

Affected Products

Astra Linux
Centos
Debian
Linuxmint
Linux Kernel
Red Os
Suse
Ubuntu