CVE-2025-37890 Details
Description
In the Linux kernel, the following vulnerability has been resolved: net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc As described in Gerrard's report [1], we have a UAF case when an hfsc class has a netem child qdisc. The crux of the issue is that hfsc is assuming that checking for cl->qdisc->q.qlen == 0 guarantees that it hasn't inserted the class in the vttree or eltree (which is not true for the netem duplicate case). This patch checks the n_active class variable to make sure that the code won't insert the class in the vttree or eltree twice, catering for the reentrant case. [1] https://lore.kernel.org/netdev/CAHcdcOm+03OD2j6R0=YHKqmy=VgJ8xEOKuP6c7mSgnp-TEJJbw@mail.gmail.com/
A use-after-free vulnerability has been identified in the Linux kernel's scheduling component, specifically within the Hierarchical Fair Service Curve (HFSC) class when it has a Netem child queue discipline. The issue arises because HFSC incorrectly assumes that a check for the queue length being zero guarantees that the class has not been inserted into the virtual tree or event tree. This assumption fails in cases where Netem creates a duplicate. The vulnerability allows for improper management of class entries, potentially leading to memory corruption or exploitation.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 10, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/141d34391abbb315d68556b7c67ad97885407547 | kernel.org | Patch |
| https://git.kernel.org/stable/c/273bbcfa53541cde38b2003ad88a59b770306421 | kernel.org | Patch |
| https://git.kernel.org/stable/c/2e7093c7a8aba5d4f8809f271488e5babe75e202 | kernel.org | Patch |
| https://git.kernel.org/stable/c/6082a87af4c52f58150d40dec1716011d871ac21 | kernel.org | Patch |
| https://git.kernel.org/stable/c/8df7d37d626430035b413b97cee18396b3450bef | kernel.org | Patch |
| https://git.kernel.org/stable/c/ac39fd4a757584d78ed062d4f6fd913f83bd98b5 | kernel.org | Patch |
| https://git.kernel.org/stable/c/e0cf8ee23e1915431f262a7b2dee0c7a7d699af0 | kernel.org | Patch |
| https://git.kernel.org/stable/c/e3e949a39a91d1f829a4890e7dfe9417ac72e4d0 | kernel.org | Patch |
| https://lists.debian.org/debian-lts-announce/2025/08/msg00010.html | CVE | Mailing List |
| https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html | CVE | Mailing List |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-416 | Use After Free | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 5.0.1, < 5.4.294 >= 5.5, < 5.10.238 >= 5.11, < 5.15.182 >= 5.16, < 6.1.138 >= 6.2, < 6.6.90 >= 6.7, < 6.12.28 >= 6.13, < 6.14.6 5.0 - 5.0 rc3 5.0 rc4 5.0 rc5 5.0 rc6 5.0 rc7 5.0 rc8 6.15 rc1 6.15 rc2 6.15 rc3 6.15 rc4 |
CPE
Remediation
| |
| debian debian linux | 11.0 |
CPE
Remediation
| |
Change History
8 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 30, 2026 | CVE Modified | kernel.org |
| Jun 17, 2026 | CVE Modified | kernel.org |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Nov 17, 2025 | Initial Analysis | [email protected] |
| Nov 3, 2025 | CVE Modified | CVE |
| Nov 3, 2025 | CVE Modified | CVE |
| Jun 4, 2025 | CVE Modified | kernel.org |
| May 16, 2025 | New CVE Received | kernel.org |