CVE-2025-38001
BaseFortify
Publication date: 2025-06-06
Last updated on: 2026-03-07
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | From 5.0.1 (inc) to 5.4.294 (exc) |
| linux | linux_kernel | From 5.5 (inc) to 5.10.238 (exc) |
| linux | linux_kernel | From 5.11 (inc) to 5.15.185 (exc) |
| linux | linux_kernel | From 5.16 (inc) to 6.1.141 (exc) |
| linux | linux_kernel | From 6.2 (inc) to 6.6.93 (exc) |
| linux | linux_kernel | From 6.7 (inc) to 6.12.32 (exc) |
| linux | linux_kernel | From 6.13 (inc) to 6.14.10 (exc) |
| linux | linux_kernel | From 6.15 (inc) to 6.15.1 (exc) |
| linux | linux_kernel | 5.0 |
| linux | linux_kernel | 5.0 |
| linux | linux_kernel | 5.0 |
| linux | linux_kernel | 5.0 |
| linux | linux_kernel | 5.0 |
| linux | linux_kernel | 5.0 |
| linux | linux_kernel | 5.0 |
| debian | debian_linux | 11.0 |
| debian | debian_linux | 12.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-835 | The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability impact me? :
This vulnerability can lead to a use-after-free condition or an infinite loop in the Linux kernel's network scheduling code. Exploiting this could cause system instability, crashes, or potentially allow an attacker to execute arbitrary code or escalate privileges by manipulating network traffic scheduling.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, update the Linux kernel to a version that includes the fix which explicitly checks in hfsc_enqueue whether the class is already in the eltree whenever the HFSC_RSC flag is set. This patch prevents the use-after-free and infinite loop issues when HFSC is used with NETEM. Until the update is applied, avoid using HFSC with NETEM and TBF configured with very low rates as root qdisc to reduce the risk of exploitation.
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's net_sched subsystem, specifically in the HFSC (Hierarchical Fair Service Curve) queuing discipline. A recent patch intended to fix an issue can be bypassed, allowing a use-after-free (UAF) condition when HFSC is used with NETEM. The problem arises because the patch only checks a certain field (cl->cl_nactive) to prevent inserting a class twice into a data structure called eltree, but this check can be bypassed using HFSC_RSC, which uses a different initialization method. This can cause the class to be inserted twice, potentially leading to an infinite loop or a UAF when combined with certain configurations like TBF with a very low rate.