CVE-2025-37890 (GCVE-0-2025-37890)

Vulnerability from cvelistv5 – Published: 2025-05-16 13:01 – Updated: 2026-08-05 11:58
VLAI
Title
net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc
Summary
In the Linux kernel, the following vulnerability has been resolved: net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc As described in Gerrard's report [1], we have a UAF case when an hfsc class has a netem child qdisc. The crux of the issue is that hfsc is assuming that checking for cl->qdisc->q.qlen == 0 guarantees that it hasn't inserted the class in the vttree or eltree (which is not true for the netem duplicate case). This patch checks the n_active class variable to make sure that the code won't insert the class in the vttree or eltree twice, catering for the reentrant case. [1] https://lore.kernel.org/netdev/CAHcdcOm+03OD2j6R0=YHKqmy=VgJ8xEOKuP6c7mSgnp-TEJJbw@mail.gmail.com/
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-10 20:42 UTC
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea , < 273bbcfa53541cde38b2003ad88a59b770306421 (git)
Affected: 37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea , < e0cf8ee23e1915431f262a7b2dee0c7a7d699af0 (git)
Affected: 37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea , < e3e949a39a91d1f829a4890e7dfe9417ac72e4d0 (git)
Affected: 37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea , < 8df7d37d626430035b413b97cee18396b3450bef (git)
Affected: 37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea , < 6082a87af4c52f58150d40dec1716011d871ac21 (git)
Affected: 37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea , < 2e7093c7a8aba5d4f8809f271488e5babe75e202 (git)
Affected: 37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea , < ac39fd4a757584d78ed062d4f6fd913f83bd98b5 (git)
Affected: 37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea , < 141d34391abbb315d68556b7c67ad97885407547 (git)
Create a notification for this product.
Linux Linux Affected: 5.0
Unaffected: 0 , < 5.0 (semver)
Unaffected: 5.4.294 , ≤ 5.4.* (semver)
Unaffected: 5.10.238 , ≤ 5.10.* (semver)
Unaffected: 5.15.182 , ≤ 5.15.* (semver)
Unaffected: 6.1.138 , ≤ 6.1.* (semver)
Unaffected: 6.6.90 , ≤ 6.6.* (semver)
Unaffected: 6.12.28 , ≤ 6.12.* (semver)
Unaffected: 6.14.6 , ≤ 6.14.* (semver)
Unaffected: 6.15 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T19:57:02.260Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/08/msg00010.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-37890",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-10T20:42:08.844756Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-11T18:44:19.853Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/sched/sch_hfsc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "273bbcfa53541cde38b2003ad88a59b770306421",
              "status": "affected",
              "version": "37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea",
              "versionType": "git"
            },
            {
              "lessThan": "e0cf8ee23e1915431f262a7b2dee0c7a7d699af0",
              "status": "affected",
              "version": "37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea",
              "versionType": "git"
            },
            {
              "lessThan": "e3e949a39a91d1f829a4890e7dfe9417ac72e4d0",
              "status": "affected",
              "version": "37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea",
              "versionType": "git"
            },
            {
              "lessThan": "8df7d37d626430035b413b97cee18396b3450bef",
              "status": "affected",
              "version": "37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea",
              "versionType": "git"
            },
            {
              "lessThan": "6082a87af4c52f58150d40dec1716011d871ac21",
              "status": "affected",
              "version": "37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea",
              "versionType": "git"
            },
            {
              "lessThan": "2e7093c7a8aba5d4f8809f271488e5babe75e202",
              "status": "affected",
              "version": "37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea",
              "versionType": "git"
            },
            {
              "lessThan": "ac39fd4a757584d78ed062d4f6fd913f83bd98b5",
              "status": "affected",
              "version": "37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea",
              "versionType": "git"
            },
            {
              "lessThan": "141d34391abbb315d68556b7c67ad97885407547",
              "status": "affected",
              "version": "37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/sched/sch_hfsc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.0"
            },
            {
              "lessThan": "5.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.294",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.238",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.182",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.138",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.90",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.28",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.14.*",
              "status": "unaffected",
              "version": "6.14.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.15",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.294",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.238",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.182",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.138",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.90",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.28",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14.6",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc\n\nAs described in Gerrard\u0027s report [1], we have a UAF case when an hfsc class\nhas a netem child qdisc. The crux of the issue is that hfsc is assuming\nthat checking for cl-\u003eqdisc-\u003eq.qlen == 0 guarantees that it hasn\u0027t inserted\nthe class in the vttree or eltree (which is not true for the netem\nduplicate case).\n\nThis patch checks the n_active class variable to make sure that the code\nwon\u0027t insert the class in the vttree or eltree twice, catering for the\nreentrant case.\n\n[1] https://lore.kernel.org/netdev/CAHcdcOm+03OD2j6R0=YHKqmy=VgJ8xEOKuP6c7mSgnp-TEJJbw@mail.gmail.com/"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires configuring an hfsc qdisc with a netem child (duplicate enabled) via RTNETLINK/tc and then transmitting packets locally, so the attacker must have local access to the system. Per kernel scoring guidance, tc/netlink qdisc bugs are Local.\nAC:L - The reentrancy is deterministic \u2014 netem\u0027s duplicate path re-enters hfsc_enqueue() synchronously on the same CPU before the child qdisc\u0027s qlen is incremented, so a single packet with duplicate=100% reliably double-activates the class. No race or uncontrolled memory-layout condition is involved.\nPR:L - Qdisc/class creation requires CAP_NET_ADMIN, but only ns_capable() over the netns owner user namespace (netlink_net_capable in rtnetlink_rcv_msg), which any unprivileged user obtains with `unshare -Urn` on default distro configs. Triggering enqueue only needs sending a packet over the local device.\nUI:N - The attacker performs every step \u2014 qdisc/class setup, packet transmission, and class deletion \u2014 with no action from any other user or administrator.\nS:U - The corruption and its consequences are confined to the kernel\u0027s own memory and scheduling structures within the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The freed hfsc_class remains linked in the parent\u0027s vt_tree/cf_tree and the eligible rbtree, so subsequent rbtree traversals read attacker-groomed heap contents; a UAF of a slab object with reclaimed contents yields a kernel information-disclosure primitive.\nI:H - Stale rb_node links cause rb_insert_color()/rb_erase()/vttree_update() to write into freed memory that the attacker can reclaim with a controlled object, giving a write primitive suitable for control-flow hijacking and privilege escalation. The doubly-inserted el_node additionally corrupts the eligible rbtree structure itself.\nA:H - Even without weaponization, the use-after-free and corrupted rbtree produce oopses, hangs on cyclic tree traversal, or a kernel panic, taking the whole system down."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:58:05.817Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/273bbcfa53541cde38b2003ad88a59b770306421"
        },
        {
          "url": "https://git.kernel.org/stable/c/e0cf8ee23e1915431f262a7b2dee0c7a7d699af0"
        },
        {
          "url": "https://git.kernel.org/stable/c/e3e949a39a91d1f829a4890e7dfe9417ac72e4d0"
        },
        {
          "url": "https://git.kernel.org/stable/c/8df7d37d626430035b413b97cee18396b3450bef"
        },
        {
          "url": "https://git.kernel.org/stable/c/6082a87af4c52f58150d40dec1716011d871ac21"
        },
        {
          "url": "https://git.kernel.org/stable/c/2e7093c7a8aba5d4f8809f271488e5babe75e202"
        },
        {
          "url": "https://git.kernel.org/stable/c/ac39fd4a757584d78ed062d4f6fd913f83bd98b5"
        },
        {
          "url": "https://git.kernel.org/stable/c/141d34391abbb315d68556b7c67ad97885407547"
        }
      ],
      "title": "net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-37890",
    "datePublished": "2025-05-16T13:01:12.798Z",
    "dateReserved": "2025-04-16T04:51:23.963Z",
    "dateUpdated": "2026-08-05T11:58:05.817Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-37890",
      "date": "2026-10-02",
      "epss": "0.00213",
      "percentile": "0.10518"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/sched/sch_hfsc.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "273bbcfa53541cde38b2003ad88a59b770306421",
                    "status": "affected",
                    "version": "37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "e0cf8ee23e1915431f262a7b2dee0c7a7d699af0",
                    "status": "affected",
                    "version": "37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "e3e949a39a91d1f829a4890e7dfe9417ac72e4d0",
                    "status": "affected",
                    "version": "37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "8df7d37d626430035b413b97cee18396b3450bef",
                    "status": "affected",
                    "version": "37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6082a87af4c52f58150d40dec1716011d871ac21",
                    "status": "affected",
                    "version": "37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "2e7093c7a8aba5d4f8809f271488e5babe75e202",
                    "status": "affected",
                    "version": "37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "ac39fd4a757584d78ed062d4f6fd913f83bd98b5",
                    "status": "affected",
                    "version": "37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "141d34391abbb315d68556b7c67ad97885407547",
                    "status": "affected",
                    "version": "37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/sched/sch_hfsc.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.0"
                  },
                  {
                    "lessThan": "5.0",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.4.*",
                    "status": "unaffected",
                    "version": "5.4.294",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.238",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.182",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.138",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.90",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.28",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.14.*",
                    "status": "unaffected",
                    "version": "6.14.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.15",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "DEC27C91-8035-49D5-8C57-B8F8541B23F7",
                    "versionEndExcluding": "5.4.294",
                    "versionStartIncluding": "5.0.1",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "0DAAEF7F-D560-47FC-8B65-20404DB82432",
                    "versionEndExcluding": "5.10.238",
                    "versionStartIncluding": "5.5",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "57E76AE8-79D9-4EC8-9845-9A86B1ED152E",
                    "versionEndExcluding": "5.15.182",
                    "versionStartIncluding": "5.11",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "B6266F82-46B4-4D38-AC4A-54C92A1DFAB2",
                    "versionEndExcluding": "6.1.138",
                    "versionStartIncluding": "5.16",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "2BE1DB09-2D62-4C63-AF19-947300669741",
                    "versionEndExcluding": "6.6.90",
                    "versionStartIncluding": "6.2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "5082CE19-0F3D-4521-AB3E-810D8255F500",
                    "versionEndExcluding": "6.12.28",
                    "versionStartIncluding": "6.7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "19E5095E-5950-43EA-8E78-FC860855293F",
                    "versionEndExcluding": "6.14.6",
                    "versionStartIncluding": "6.13",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:5.0:-:*:*:*:*:*:*",
                    "matchCriteriaId": "1D0FE595-0CFE-4491-808B-CEF691CE7B0A",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:5.0:rc3:*:*:*:*:*:*",
                    "matchCriteriaId": "963CFC36-FBAD-465F-9891-CDBBF962DFDD",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:5.0:rc4:*:*:*:*:*:*",
                    "matchCriteriaId": "1B084A7A-6047-4804-9395-6000E4A43828",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:5.0:rc5:*:*:*:*:*:*",
                    "matchCriteriaId": "C3430640-AC87-44BF-ABF5-09E0A97E3758",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:5.0:rc6:*:*:*:*:*:*",
                    "matchCriteriaId": "FDF49B77-4688-4908-9239-89B729456D22",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:5.0:rc7:*:*:*:*:*:*",
                    "matchCriteriaId": "77F342FB-3D7B-4EAE-BF8B-57B7B860BAFD",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:5.0:rc8:*:*:*:*:*:*",
                    "matchCriteriaId": "47D61679-6515-4E18-83C7-A71982CCD83C",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "8D465631-2980-487A-8E65-40AE2B9F8ED1",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "4C9D071F-B28E-46EC-AC61-22B913390211",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc3:*:*:*:*:*:*",
                    "matchCriteriaId": "13FC0DDE-E513-465E-9E81-515702D49B74",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc4:*:*:*:*:*:*",
                    "matchCriteriaId": "8C7B5B0E-4EEB-48F5-B4CF-0935A7633845",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*",
                    "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc\n\nAs described in Gerrard\u0027s report [1], we have a UAF case when an hfsc class\nhas a netem child qdisc. The crux of the issue is that hfsc is assuming\nthat checking for cl-\u003eqdisc-\u003eq.qlen == 0 guarantees that it hasn\u0027t inserted\nthe class in the vttree or eltree (which is not true for the netem\nduplicate case).\n\nThis patch checks the n_active class variable to make sure that the code\nwon\u0027t insert the class in the vttree or eltree twice, catering for the\nreentrant case.\n\n[1] https://lore.kernel.org/netdev/CAHcdcOm+03OD2j6R0=YHKqmy=VgJ8xEOKuP6c7mSgnp-TEJJbw@mail.gmail.com/"
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net_sched: hfsc: corrige una vulnerabilidad UAF en la clase con netem como qdisc hijo Como se describe en el informe de Gerrard [1], tenemos un caso UAF cuando una clase hfsc tiene una qdisc hijo netem. El quid de la cuesti\u00f3n es que hfsc asume que la comprobaci\u00f3n de cl-\u0026gt;qdisc-\u0026gt;q.qlen == 0 garantiza que no ha insertado la clase en vttree o eltree (lo que no es cierto para el caso de duplicado de netem). Este parche comprueba la variable de clase n_active para asegurarse de que el c\u00f3digo no inserte la clase en vttree o eltree dos veces, atendiendo al caso reentrante. [1] https://lore.kernel.org/netdev/CAHcdcOm+03OD2j6R0=YHKqmy=VgJ8xEOKuP6c7mSgnp-TEJJbw@mail.gmail.com/"
          }
        ],
        "id": "CVE-2025-37890",
        "lastModified": "2026-07-30T06:22:28.833",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2025-37890",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-10T20:42:08.844756Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2025-05-16T13:15:52.437",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/141d34391abbb315d68556b7c67ad97885407547"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/273bbcfa53541cde38b2003ad88a59b770306421"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/2e7093c7a8aba5d4f8809f271488e5babe75e202"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/6082a87af4c52f58150d40dec1716011d871ac21"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/8df7d37d626430035b413b97cee18396b3450bef"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/ac39fd4a757584d78ed062d4f6fd913f83bd98b5"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/e0cf8ee23e1915431f262a7b2dee0c7a7d699af0"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/e3e949a39a91d1f829a4890e7dfe9417ac72e4d0"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Mailing List"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2025/08/msg00010.html"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Mailing List"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-416"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-07-30T09:01:57+00:00",
      "cve": "CVE-2025-37890",
      "id": "CVE-2025-37890",
      "initial_release_date": "2025-05-16T00:00:00+00:00",
      "product_status:fixed": "1854",
      "product_status:known_affected": "22",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-37890.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2025-11-03T19:57:02.260Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
              },
              {
                "url": "https://lists.debian.org/debian-lts-announce/2025/08/msg00010.html"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2025-37890",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-06-10T20:42:08.844756Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-06-11T17:39:06.216Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "net/sched/sch_hfsc.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "273bbcfa53541cde38b2003ad88a59b770306421",
                  "status": "affected",
                  "version": "37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea",
                  "versionType": "git"
                },
                {
                  "lessThan": "e0cf8ee23e1915431f262a7b2dee0c7a7d699af0",
                  "status": "affected",
                  "version": "37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea",
                  "versionType": "git"
                },
                {
                  "lessThan": "e3e949a39a91d1f829a4890e7dfe9417ac72e4d0",
                  "status": "affected",
                  "version": "37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea",
                  "versionType": "git"
                },
                {
                  "lessThan": "8df7d37d626430035b413b97cee18396b3450bef",
                  "status": "affected",
                  "version": "37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea",
                  "versionType": "git"
                },
                {
                  "lessThan": "6082a87af4c52f58150d40dec1716011d871ac21",
                  "status": "affected",
                  "version": "37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea",
                  "versionType": "git"
                },
                {
                  "lessThan": "2e7093c7a8aba5d4f8809f271488e5babe75e202",
                  "status": "affected",
                  "version": "37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea",
                  "versionType": "git"
                },
                {
                  "lessThan": "ac39fd4a757584d78ed062d4f6fd913f83bd98b5",
                  "status": "affected",
                  "version": "37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea",
                  "versionType": "git"
                },
                {
                  "lessThan": "141d34391abbb315d68556b7c67ad97885407547",
                  "status": "affected",
                  "version": "37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea",
                  "versionType": "git"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "net/sched/sch_hfsc.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "5.0"
                },
                {
                  "lessThan": "5.0",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.4.*",
                  "status": "unaffected",
                  "version": "5.4.294",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.10.*",
                  "status": "unaffected",
                  "version": "5.10.238",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.15.*",
                  "status": "unaffected",
                  "version": "5.15.182",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.1.*",
                  "status": "unaffected",
                  "version": "6.1.138",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.6.*",
                  "status": "unaffected",
                  "version": "6.6.90",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.12.*",
                  "status": "unaffected",
                  "version": "6.12.28",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.14.*",
                  "status": "unaffected",
                  "version": "6.14.6",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "6.15",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.4.294",
                      "versionStartIncluding": "5.0",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.10.238",
                      "versionStartIncluding": "5.0",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.15.182",
                      "versionStartIncluding": "5.0",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.1.138",
                      "versionStartIncluding": "5.0",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.6.90",
                      "versionStartIncluding": "5.0",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.12.28",
                      "versionStartIncluding": "5.0",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.14.6",
                      "versionStartIncluding": "5.0",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.15",
                      "versionStartIncluding": "5.0",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc\n\nAs described in Gerrard\u0027s report [1], we have a UAF case when an hfsc class\nhas a netem child qdisc. The crux of the issue is that hfsc is assuming\nthat checking for cl-\u003eqdisc-\u003eq.qlen == 0 guarantees that it hasn\u0027t inserted\nthe class in the vttree or eltree (which is not true for the netem\nduplicate case).\n\nThis patch checks the n_active class variable to make sure that the code\nwon\u0027t insert the class in the vttree or eltree twice, catering for the\nreentrant case.\n\n[1] https://lore.kernel.org/netdev/CAHcdcOm+03OD2j6R0=YHKqmy=VgJ8xEOKuP6c7mSgnp-TEJJbw@mail.gmail.com/"
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              }
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-07-30T05:49:42.072Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/273bbcfa53541cde38b2003ad88a59b770306421"
            },
            {
              "url": "https://git.kernel.org/stable/c/e0cf8ee23e1915431f262a7b2dee0c7a7d699af0"
            },
            {
              "url": "https://git.kernel.org/stable/c/e3e949a39a91d1f829a4890e7dfe9417ac72e4d0"
            },
            {
              "url": "https://git.kernel.org/stable/c/8df7d37d626430035b413b97cee18396b3450bef"
            },
            {
              "url": "https://git.kernel.org/stable/c/6082a87af4c52f58150d40dec1716011d871ac21"
            },
            {
              "url": "https://git.kernel.org/stable/c/2e7093c7a8aba5d4f8809f271488e5babe75e202"
            },
            {
              "url": "https://git.kernel.org/stable/c/ac39fd4a757584d78ed062d4f6fd913f83bd98b5"
            },
            {
              "url": "https://git.kernel.org/stable/c/141d34391abbb315d68556b7c67ad97885407547"
            }
          ],
          "title": "net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2025-37890",
        "datePublished": "2025-05-16T13:01:12.798Z",
        "dateReserved": "2025-04-16T04:51:23.963Z",
        "dateUpdated": "2026-07-30T05:49:42.072Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.