LiveActive security incident?Get immediate response
CVE Record

CVE-2025-37890: net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc

In the Linux kernel, the following vulnerability has been resolved: net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc As described in Gerrard's report [1], we have a UAF case when an hfsc class has a netem child qdisc. The crux of the issue is that hfsc is assuming that checking for cl->qdisc->q.qlen == 0 guarantees that it hasn't inserted the class in the vttree or eltree (which is not true for the netem duplicate case). This patch checks the n_active class variable to make sure that the code won't insert the class in the vttree or eltree twice, catering for the reentrant case. [1] https://lore.kernel.org/netdev/CAHcdcOm+03OD2j6R0=YHKqmy=VgJ8xEOKuP6c7mSgnp-TEJJbw@mail.gmail.com/

HighCVSS 7.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A Linux traffic-control flaw can cause the kernel to reuse freed memory when HFSC scheduling has a netem child. A low-privileged local attacker may potentially compromise confidentiality, integrity, and availability. Exploitation requires local access and the specific traffic-control condition.

Executive priority

Prioritize affected shared or multi-user Linux systems because successful exploitation could compromise the host. Treat remediation as high priority, while recognizing that the issue is local rather than remotely reachable and active exploitation is not established.

Technical view

HFSC incorrectly treats an empty queue as proof that a class was not inserted into its virtual-time or eligible trees. With a netem duplicate and reentrant processing, the class can be inserted twice, producing a use-after-free. The stable fix checks the active-class state before insertion.

Likely exposure

Exposure is limited to affected Linux kernels where a local low-privileged actor can reach the vulnerable HFSC-with-netem configuration. The source bundle lists multiple affected kernel lines but does not clearly express complete version ranges, so distribution backport status must be verified.

Exploitation context

The CVSS 3.1 score is 7.8 with local access, low complexity, low privileges, and no user interaction. Potential impact spans confidentiality, integrity, and availability. The bundle says KEV is false and provides no evidence of active exploitation.

Researcher notes

The source bundle does not assign a CWE. Root cause is duplicate HFSC class insertion during a reentrant netem duplicate case, leading to use-after-free. Multiple stable commits are supplied, suggesting fixes across kernel branches. Exact affected ranges and exploit reliability are not established by the provided evidence.

Mitigation direction

  • Install a vendor-supported kernel containing the applicable upstream stable fix.
  • Check Linux distribution advisories for backported fixes rather than relying only on kernel version numbers.
  • If patching is delayed, consult vendor guidance for supported temporary mitigations.

Validation and detection

  • Record each system's running kernel version, distribution release, and package revision.
  • Confirm through vendor advisories that the installed kernel includes a CVE-2025-37890 backport.
  • Identify systems using HFSC classes with netem child queue disciplines.
  • Reboot after updating and verify the corrected kernel is running.
Prepared
Confidence
high
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-37890 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
2ADP providers
11Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: total

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.8CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.8High
CVSS 3.1 vector shape for CVE-2025-37890Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container
CISA-ADPCISA ADP Vulnrichment
other:ssvc

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea, 37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea, 37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea, 37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea, 37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea, 37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea, 37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea, 37d9cf1a3ce35de3df6f7d209bfb1f50cf188ceaunaffected
LinuxLinux5.0, 0, 5.4.294, 5.10.238, 5.15.182, 6.1.138, 6.6.90, 6.12.28, 6.14.6, 6.15affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.