CVE-2025-38001

Published Jun 6, 2025

Last updated 3 months ago

Linux Kernel

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-38001 is a vulnerability in the Linux kernel affecting the Hierarchical Fair Service Curve (HFSC) scheduler component. Disclosed on June 6, 2025, it involves a use-after-free (UAF) condition when HFSC is used with NETEM. The vulnerability stems from a bypass in a previous patch that attempted to address re-entrant enqueue issues. The flaw occurs because the patch only checks the `cl->cl_nactive` field to determine first insertion, but this field is only incremented by `init_vf`. By using `HFSC_RSC` (which uses `inited`), it's possible to bypass the check and insert the class twice in the eltree. This can lead to an infinite loop in `hfsc_dequeue` under normal conditions, but when combined with TBF as root qdisc configured with a very low rate, it can prevent packets from being dequeued, enabling subsequent insertions in the HFSC eltree and causing a UAF condition.

Description: In the Linux kernel, the following vulnerability has been resolved: net_sched: hfsc: Address reentrant enqueue adding class to eltree twice Savino says: "We are writing to report that this recent patch (141d34391abbb315d68556b7c67ad97885407547) [1] can be bypassed, and a UAF can still occur when HFSC is utilized with NETEM. The patch only checks the cl->cl_nactive field to determine whether it is the first insertion or not [2], but this field is only incremented by init_vf [3]. By using HFSC_RSC (which uses init_ed) [4], it is possible to bypass the check and insert the class twice in the eltree. Under normal conditions, this would lead to an infinite loop in hfsc_dequeue for the reasons we already explained in this report [5]. However, if TBF is added as root qdisc and it is configured with a very low rate, it can be utilized to prevent packets from being dequeued. This behavior can be exploited to perform subsequent insertions in the HFSC eltree and cause a UAF." To fix both the UAF and the infinite loop, with netem as an hfsc child, check explicitly in hfsc_enqueue whether the class is already in the eltree whenever the HFSC_RSC flag is set. [1] https://web.git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=141d34391abbb315d68556b7c67ad97885407547 [2] https://elixir.bootlin.com/linux/v6.15-rc5/source/net/sched/sch_hfsc.c#L1572 [3] https://elixir.bootlin.com/linux/v6.15-rc5/source/net/sched/sch_hfsc.c#L677 [4] https://elixir.bootlin.com/linux/v6.15-rc5/source/net/sched/sch_hfsc.c#L1574 [5] https://lore.kernel.org/netdev/8DuRWwfqjoRDLDmBMlIfbrsZg9Gx50DHJc1ilxsEBNe2D6NMoigR_eIRIG0LOjMc3r10nUUZtArXx4oZBIdUfZQrwjcQhdinnMis_0G7VEk=@willsroot.io/T/#u
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
NVD status: Modified
Products: linux_kernel, debian_linux

Risk scores

CVSS 3.1

Type: Primary
Base score: 5.5
Impact score: 3.6
Exploitability score: 1.8
Vector string: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Severity: MEDIUM

Weaknesses

nvd@nist.gov: CWE-835

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "DEC27C91-8035-49D5-8C57-B8F8541B23F7",
            "versionEndExcluding": "5.4.294",
            "versionStartIncluding": "5.0.1",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "0DAAEF7F-D560-47FC-8B65-20404DB82432",
            "versionEndExcluding": "5.10.238",
            "versionStartIncluding": "5.5",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "E11820B2-24BD-40A8-9E6B-5BC447252321",
            "versionEndExcluding": "5.15.185",
            "versionStartIncluding": "5.11",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "7CEA8241-A858-4009-B4EE-31C62772811A",
            "versionEndExcluding": "6.1.141",
            "versionStartIncluding": "5.16",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "50A4A9DE-24AB-4FB4-AACD-85D8EABB0571",
            "versionEndExcluding": "6.6.93",
            "versionStartIncluding": "6.2",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "E3930985-A25E-4043-A450-F01B563C0DA5",
            "versionEndExcluding": "6.12.32",
            "versionStartIncluding": "6.7",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "DB4249FA-EF24-4488-A579-B8E8EE87EA6F",
            "versionEndExcluding": "6.14.10",
            "versionStartIncluding": "6.13",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "ACD734B1-0431-4BEB-9769-ECB016833EB2",
            "versionEndExcluding": "6.15.1",
            "versionStartIncluding": "6.15",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:5.0:-:*:*:*:*:*:*",
            "matchCriteriaId": "1D0FE595-0CFE-4491-808B-CEF691CE7B0A",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:5.0:rc3:*:*:*:*:*:*",
            "matchCriteriaId": "963CFC36-FBAD-465F-9891-CDBBF962DFDD",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:5.0:rc4:*:*:*:*:*:*",
            "matchCriteriaId": "1B084A7A-6047-4804-9395-6000E4A43828",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:5.0:rc5:*:*:*:*:*:*",
            "matchCriteriaId": "C3430640-AC87-44BF-ABF5-09E0A97E3758",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:5.0:rc6:*:*:*:*:*:*",
            "matchCriteriaId": "FDF49B77-4688-4908-9239-89B729456D22",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:5.0:rc7:*:*:*:*:*:*",
            "matchCriteriaId": "77F342FB-3D7B-4EAE-BF8B-57B7B860BAFD",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:5.0:rc8:*:*:*:*:*:*",
            "matchCriteriaId": "47D61679-6515-4E18-83C7-A71982CCD83C",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  },
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*",
            "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*",
            "matchCriteriaId": "46D69DCC-AE4D-4EA5-861C-D60951444C6C",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.