UAF Vulnerability in Linux Kernel's HFSC Class with Netem Child Qdisc
Summary
CVE-2025-37890: In the Linux kernel, the following vulnerability has been resolved: net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc As described in Gerrard's report [1], we have a UAF case when an hfsc class... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services for hardware and software interaction. It supports a wide range of functionalities, including process management, memory management, and networking. This vulnerability specifically affects the HFSC (Hierarchical Fair Service Curve) class when it has a netem (network emulator) child queuing discipline, leading to potential security risks.
Vulnerability Detail
In the Linux kernel, a use-after-free (UAF) vulnerability has been identified in the HFSC class when it is used with a netem child qdisc. The issue arises because the HFSC class incorrectly assumes that checking the queue length of the child qdisc guarantees that the class has not been inserted into the virtual tree structures. This assumption is flawed, particularly in cases where netem duplicates exist, potentially leading to memory corruption and exploitation by attackers.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is recommended to apply the patch by updating the Linux package to mitigate the risk.
Conclusion
The UAF vulnerability in the Linux kernel's HFSC class with a netem child qdisc poses significant security risks. Users are strongly advised to update their Linux packages to the latest versions to mitigate these risks. Regular monitoring using tools like Vulert can also help in identifying vulnerabilities in open-source software.
See every vulnerability recorded for linux →
FAQ
A use-after-free vulnerability occurs when a program continues to use a memory location after it has been freed, which can lead to unpredictable behavior and security risks.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. By uploading your manifest file like package-lock.json, Vulert can help identify if your application is affected.
Exploitation of this vulnerability could lead to memory corruption, allowing attackers to execute arbitrary code or crash the system.
The vulnerability affects multiple versions of the Linux kernel across Debian 11, 12, and 13. It is crucial to update to the latest patched version.
Detailed information can be found in the Linux kernel mailing list archives and security advisories related to the specific CVE.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
