CVE - CVE-2025-37797

CVE-ID
CVE-2025-37797	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
In the Linux kernel, the following vulnerability has been resolved: net_sched: hfsc: Fix a UAF vulnerability in class handling This patch fixes a Use-After-Free vulnerability in the HFSC qdisc class handling. The issue occurs due to a time-of-check/time-of-use condition in hfsc_change_class() when working with certain child qdiscs like netem or codel. The vulnerability works as follows: 1. hfsc_change_class() checks if a class has packets (q.qlen != 0) 2. It then calls qdisc_peek_len(), which for certain qdiscs (e.g., codel, netem) might drop packets and empty the queue 3. The code continues assuming the queue is still non-empty, adding the class to vttree 4. This breaks HFSC scheduler assumptions that only non-empty classes are in vttree 5. Later, when the class is destroyed, this can lead to a Use-After-Free The fix adds a second queue length check after qdisc_peek_len() to verify the queue wasn't emptied.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
MISC:https://git.kernel.org/stable/c/20d584a33e480ae80d105f43e0e7b56784da41b9 URL:https://git.kernel.org/stable/c/20d584a33e480ae80d105f43e0e7b56784da41b9 MISC:https://git.kernel.org/stable/c/28b09a067831f7317c3841812276022d6c940677 URL:https://git.kernel.org/stable/c/28b09a067831f7317c3841812276022d6c940677 MISC:https://git.kernel.org/stable/c/39b9095dd3b55d9b2743df038c32138efa34a9de URL:https://git.kernel.org/stable/c/39b9095dd3b55d9b2743df038c32138efa34a9de MISC:https://git.kernel.org/stable/c/3aa852e3605000d5c47035c3fc3a986d14ccfa9f URL:https://git.kernel.org/stable/c/3aa852e3605000d5c47035c3fc3a986d14ccfa9f MISC:https://git.kernel.org/stable/c/3df275ef0a6ae181e8428a6589ef5d5231e58b5c URL:https://git.kernel.org/stable/c/3df275ef0a6ae181e8428a6589ef5d5231e58b5c MISC:https://git.kernel.org/stable/c/86cd4641c713455a4f1c8e54c370c598c2b1cee0 URL:https://git.kernel.org/stable/c/86cd4641c713455a4f1c8e54c370c598c2b1cee0 MISC:https://git.kernel.org/stable/c/bb583c88d23b72d8d16453d24856c99bd93dadf5 URL:https://git.kernel.org/stable/c/bb583c88d23b72d8d16453d24856c99bd93dadf5 MISC:https://git.kernel.org/stable/c/fcc8ede663569c704fb00a702973bd6c00373283 URL:https://git.kernel.org/stable/c/fcc8ede663569c704fb00a702973bd6c00373283
Assigning CNA
kernel.org
Date Record Created
20250416	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20250416)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)