{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2025-38001", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T04:51:23.976Z", "datePublished": "2025-06-06T13:41:45.462Z", "dateUpdated": "2026-08-05T11:58:52.422Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:58:52.422Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet_sched: hfsc: Address reentrant enqueue adding class to eltree twice\n\nSavino says:\n \"We are writing to report that this recent patch\n (141d34391abbb315d68556b7c67ad97885407547) [1]\n can be bypassed, and a UAF can still occur when HFSC is utilized with\n NETEM.\n\n The patch only checks the cl->cl_nactive field to determine whether\n it is the first insertion or not [2], but this field is only\n incremented by init_vf [3].\n\n By using HFSC_RSC (which uses init_ed) [4], it is possible to bypass the\n check and insert the class twice in the eltree.\n Under normal conditions, this would lead to an infinite loop in\n hfsc_dequeue for the reasons we already explained in this report [5].\n\n However, if TBF is added as root qdisc and it is configured with a\n very low rate,\n it can be utilized to prevent packets from being dequeued.\n This behavior can be exploited to perform subsequent insertions in the\n HFSC eltree and cause a UAF.\"\n\nTo fix both the UAF and the infinite loop, with netem as an hfsc child,\ncheck explicitly in hfsc_enqueue whether the class is already in the eltree\nwhenever the HFSC_RSC flag is set.\n\n[1] https://web.git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=141d34391abbb315d68556b7c67ad97885407547\n[2] https://elixir.bootlin.com/linux/v6.15-rc5/source/net/sched/sch_hfsc.c#L1572\n[3] https://elixir.bootlin.com/linux/v6.15-rc5/source/net/sched/sch_hfsc.c#L677\n[4] https://elixir.bootlin.com/linux/v6.15-rc5/source/net/sched/sch_hfsc.c#L1574\n[5] https://lore.kernel.org/netdev/8DuRWwfqjoRDLDmBMlIfbrsZg9Gx50DHJc1ilxsEBNe2D6NMoigR_eIRIG0LOjMc3r10nUUZtArXx4oZBIdUfZQrwjcQhdinnMis_0G7VEk=@willsroot.io/T/#u" } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - Exploitation requires configuring an HFSC qdisc with an RSC-only class, a netem child with duplication, and a rate-limiting root qdisc via tc/rtnetlink, then transmitting packets locally through it. Remote peers cannot set up or reach this configuration, so local access is required.\nAC:L - The attacker fully controls every precondition — the HFSC_RSC class flags, netem's duplicate probability (settable to 100%), and the TBF rate that stalls dequeue — so the reentrant double-insertion is triggered deterministically on demand, with no race or state outside attacker control.\nPR:L - CAP_NET_ADMIN is required for tc configuration, but rtnetlink checks it namespace-relative, so an unprivileged user obtains it by creating a user+network namespace (unshare -Urn) and building the qdisc hierarchy on a loopback/dummy device inside it.\nUI:N - The attacker performs the qdisc setup and generates the triggering traffic entirely on their own; no action by any other user or administrator is involved.\nS:U - The corruption is confined to kernel heap memory managed by the same kernel security authority; there is no crossing of a VM, IOMMU, or other trust boundary.\nC:H - The stale eligible-tree edge to a freed hfsc_class yields a use-after-free that is read from during rbtree traversal in eltree_get_mindl()/eltree_get_minel(), and reclaiming the freed slab object with attacker-controlled data gives an arbitrary kernel-memory read primitive.\nI:H - rb_insert_color() and rb_erase() write parent/color pointers into the freed object and into attacker-groomed neighbors, providing a controllable write primitive on reclaimed heap memory that is leverageable for full local privilege escalation.\nA:H - Even without full exploitation, the double insertion causes an infinite loop in hfsc_dequeue() or a use-after-free oops/panic, hanging or crashing the kernel." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/sched/sch_hfsc.c" ], "versions": [ { "version": "37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea", "lessThan": "e5bee633cc276410337d54b99f77fbc1ad8801e5", "status": "affected", "versionType": "git" }, { "version": "37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea", "lessThan": "6672e6c00810056acaac019fe26cdc26fee8a66c", "status": "affected", "versionType": "git" }, { "version": "37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea", "lessThan": "2c928b3a0b04a431ffcd6c8b7d88a267124a3a28", "status": "affected", "versionType": "git" }, { "version": "37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea", "lessThan": "a0ec22fa20b252edbe070a9de8501eef63c17ef5", "status": "affected", "versionType": "git" }, { "version": "37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea", "lessThan": "295f7c579b07b5b7cf2dffe485f71cc2f27647cb", "status": "affected", "versionType": "git" }, { "version": "37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea", "lessThan": "2f2190ce4ca972051cac6a8d7937448f8cb9673c", "status": "affected", "versionType": "git" }, { "version": "37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea", "lessThan": "4e38eaaabfb7fffbb371a51150203e19eee5d70e", "status": "affected", "versionType": "git" }, { "version": "37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea", "lessThan": "39ed887b1dd2d6b720f87e86692ac3006cc111c8", "status": "affected", "versionType": "git" }, { "version": "37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea", "lessThan": "ac9fe7dd8e730a103ae4481147395cc73492d786", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/sched/sch_hfsc.c" ], "versions": [ { "version": "5.0", "status": "affected" }, { "version": "0", "lessThan": "5.0", "status": "unaffected", "versionType": "semver" }, { "version": "5.4.294", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.238", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.185", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.141", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.93", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.32", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.14.10", "lessThanOrEqual": "6.14.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.15.1", "lessThanOrEqual": "6.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.16", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.0", "versionEndExcluding": "5.4.294" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.0", "versionEndExcluding": "5.10.238" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.0", "versionEndExcluding": "5.15.185" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.0", "versionEndExcluding": "6.1.141" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.0", "versionEndExcluding": "6.6.93" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.0", "versionEndExcluding": "6.12.32" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.0", "versionEndExcluding": "6.14.10" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.0", "versionEndExcluding": "6.15.1" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.0", "versionEndExcluding": "6.16" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/e5bee633cc276410337d54b99f77fbc1ad8801e5" }, { "url": "https://git.kernel.org/stable/c/6672e6c00810056acaac019fe26cdc26fee8a66c" }, { "url": "https://git.kernel.org/stable/c/2c928b3a0b04a431ffcd6c8b7d88a267124a3a28" }, { "url": "https://git.kernel.org/stable/c/a0ec22fa20b252edbe070a9de8501eef63c17ef5" }, { "url": "https://git.kernel.org/stable/c/295f7c579b07b5b7cf2dffe485f71cc2f27647cb" }, { "url": "https://git.kernel.org/stable/c/2f2190ce4ca972051cac6a8d7937448f8cb9673c" }, { "url": "https://git.kernel.org/stable/c/4e38eaaabfb7fffbb371a51150203e19eee5d70e" }, { "url": "https://git.kernel.org/stable/c/39ed887b1dd2d6b720f87e86692ac3006cc111c8" }, { "url": "https://git.kernel.org/stable/c/ac9fe7dd8e730a103ae4481147395cc73492d786" }, { "url": "https://syst3mfailure.io/rbtree-family-drama/" } ], "title": "net_sched: hfsc: Address reentrant enqueue adding class to eltree twice", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "title": "CVE Program Container", "references": [ { "url": "https://syst3mfailure.io/rbtree-family-drama/" }, { "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html" }, { "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html" } ], "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T17:33:00.634Z" } } ] } }