PT-2025-24274 · Linux +6 · Linux Kernel +6

Savino · Published 2025-05-22 · Updated 2025-11-13 · CVE-2025-38001

Positive Technologies · (AI Summary)

CVSS v2.0

5.7

5.7

Medium

Base vector

AV:L/AC:L/Au:S/C:P/I:P/A:C

Name of the Vulnerable Software and Affected Versions

Linux kernel versions prior to the fix included in commit 141d34391abbb315d68556b7c67ad97885407547.

Description

The Linux kernel contains a vulnerability in the

net sched

subsystem, specifically within the HFSC (Hierarchical Fair Queuing) scheduler. A use-after-free (UAF) condition can occur when HFSC is used in conjunction with NETEM (Network Emulator). The vulnerability arises because the patch intended to prevent double insertion into the eltree can be bypassed. Specifically, the check for existing class insertion is insufficient when using HFSC RSC, allowing a class to be inserted twice. This can lead to an infinite loop in

hfsc dequeue

under normal conditions, or, if TBF (Token Bucket Filter) is used as a root qdisc with a low rate, it can be exploited to cause a UAF.

Recommendations

Update the Linux kernel to a version that includes the fix from commit 141d34391abbb315d68556b7c67ad97885407547. As a temporary workaround, consider disabling the

hfsc

queuing discipline or avoiding the use of HFSC with NETEM until a patched version is available.

Exploit

Fix

Infinite Loop

Weakness Enumeration

CWE-835

Related Identifiers

BDU:2025-12349

CESA-2025_16582

CVE-2025-38001

DLA-4327-1

DLA-4328-1

DSA-5973-1

ECHO-8B54-DB62-922A

OESA-2025-2077

OESA-2025-2078

OESA-2025-2079

OESA-2025-2081

OESA-2025-2082

RHSA-2025:12209

RHSA-2025:12311

RHSA-2025:14511

RHSA-2025:14692

RHSA-2025:14742

RHSA-2025:14744

SUSE-SU-2025:02249-1

SUSE-SU-2025:02264-1

SUSE-SU-2025:02308-1

SUSE-SU-2025:02537-1

SUSE-SU-2025:02538-1

SUSE-SU-2025:02923-1

SUSE-SU-2025:03097-1

SUSE-SU-2025:03100-1

SUSE-SU-2025:03104-1

SUSE-SU-2025:03106-1

SUSE-SU-2025:03108-1

SUSE-SU-2025:03109-1

SUSE-SU-2025:03111-1

SUSE-SU-2025:03124-1

SUSE-SU-2025:03126-1

SUSE-SU-2025:03129-1

SUSE-SU-2025:03130-1

SUSE-SU-2025:03156-1

SUSE-SU-2025:03160-1

SUSE-SU-2025:03179-1

SUSE-SU-2025:03180-1

SUSE-SU-2025:03181-1

SUSE-SU-2025:03182-1

SUSE-SU-2025:03184-1

SUSE-SU-2025:03185-1

SUSE-SU-2025:03186-1

SUSE-SU-2025:03190-1

SUSE-SU-2025:03191-1

SUSE-SU-2025:03194-1

SUSE-SU-2025:03195-1

SUSE-SU-2025:03215-1

SUSE-SU-2025_02249-1

SUSE-SU-2025_02254-1

SUSE-SU-2025_02264-1

SUSE-SU-2025_02307-1

SUSE-SU-2025_02308-1

SUSE-SU-2025_02333-1

SUSE-SU-2025_02335-1

SUSE-SU-2025_02537-1

SUSE-SU-2025_02538-1

USN-7608-1

USN-7608-2

USN-7608-3

USN-7608-4

USN-7608-5

USN-7608-6

USN-7608-7

USN-7609-1

USN-7609-2

USN-7609-3

USN-7609-4

USN-7609-5

USN-7610-1

USN-7610-2

USN-7610-3

USN-7611-1

USN-7611-2

USN-7611-3

USN-7611-4

USN-7618-1

USN-7628-1

USN-7653-1

USN-7655-1

USN-7665-2

USN-7671-1

USN-7671-2

USN-7671-3

USN-7686-1

USN-7712-1

USN-7712-2

Affected Products

Astra Linux

Centos

Debian

Linuxmint

Linux Kernel

Suse

Ubuntu

References · 5309

• 🔥 https://github.com/0xdevil/CVE-2025-38001 · Exploit
• 🔥 https://github.com/aels/CVE-2022-2586-LPE · Exploit
• 🔥 https://github.com/sniper404ghostxploit/CVE-2022-2586 · Exploit
• 🔥 https://github.com/0xdevil/security-research/tree/CVE-2025-38001/pocs/linux/kernelctf/CVE-2025-38001_lts_cos_mitigation · Exploit
• https://ubuntu.com/security/CVE-2025-37758 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-12182 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38466 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2025-38001 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-37995 · Security Note
• https://ubuntu.com/security/CVE-2025-37970 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22039 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21909 · Security Note
• https://bdu.fstec.ru/vul/2025-11343 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21721 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38215 · Security Note