CVE-2025-37890

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-37890", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T04:51:23.963Z", "datePublished": "2025-05-16T13:01:12.798Z", "dateUpdated": "2026-08-05T11:58:05.817Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:58:05.817Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc\n\nAs described in Gerrard's report [1], we have a UAF case when an hfsc class\nhas a netem child qdisc. The crux of the issue is that hfsc is assuming\nthat checking for cl->qdisc->q.qlen == 0 guarantees that it hasn't inserted\nthe class in the vttree or eltree (which is not true for the netem\nduplicate case).\n\nThis patch checks the n_active class variable to make sure that the code\nwon't insert the class in the vttree or eltree twice, catering for the\nreentrant case.\n\n[1] https://lore.kernel.org/netdev/CAHcdcOm+03OD2j6R0=YHKqmy=VgJ8xEOKuP6c7mSgnp-TEJJbw@mail.gmail.com/"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - Exploitation requires configuring an hfsc qdisc with a netem child (duplicate enabled) via RTNETLINK/tc and then transmitting packets locally, so the attacker must have local access to the system. Per kernel scoring guidance, tc/netlink qdisc bugs are Local.\nAC:L - The reentrancy is deterministic \u2014 netem's duplicate path re-enters hfsc_enqueue() synchronously on the same CPU before the child qdisc's qlen is incremented, so a single packet with duplicate=100% reliably double-activates the class. No race or uncontrolled memory-layout condition is involved.\nPR:L - Qdisc/class creation requires CAP_NET_ADMIN, but only ns_capable() over the netns owner user namespace (netlink_net_capable in rtnetlink_rcv_msg), which any unprivileged user obtains with `unshare -Urn` on default distro configs. Triggering enqueue only needs sending a packet over the local device.\nUI:N - The attacker performs every step \u2014 qdisc/class setup, packet transmission, and class deletion \u2014 with no action from any other user or administrator.\nS:U - The corruption and its consequences are confined to the kernel's own memory and scheduling structures within the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The freed hfsc_class remains linked in the parent's vt_tree/cf_tree and the eligible rbtree, so subsequent rbtree traversals read attacker-groomed heap contents; a UAF of a slab object with reclaimed contents yields a kernel information-disclosure primitive.\nI:H - Stale rb_node links cause rb_insert_color()/rb_erase()/vttree_update() to write into freed memory that the attacker can reclaim with a controlled object, giving a write primitive suitable for control-flow hijacking and privilege escalation. The doubly-inserted el_node additionally corrupts the eligible rbtree structure itself.\nA:H - Even without weaponization, the use-after-free and corrupted rbtree produce oopses, hangs on cyclic tree traversal, or a kernel panic, taking the whole system down."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/sched/sch_hfsc.c"], "versions": [{"version": "37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea", "lessThan": "273bbcfa53541cde38b2003ad88a59b770306421", "status": "affected", "versionType": "git"}, {"version": "37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea", "lessThan": "e0cf8ee23e1915431f262a7b2dee0c7a7d699af0", "status": "affected", "versionType": "git"}, {"version": "37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea", "lessThan": "e3e949a39a91d1f829a4890e7dfe9417ac72e4d0", "status": "affected", "versionType": "git"}, {"version": "37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea", "lessThan": "8df7d37d626430035b413b97cee18396b3450bef", "status": "affected", "versionType": "git"}, {"version": "37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea", "lessThan": "6082a87af4c52f58150d40dec1716011d871ac21", "status": "affected", "versionType": "git"}, {"version": "37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea", "lessThan": "2e7093c7a8aba5d4f8809f271488e5babe75e202", "status": "affected", "versionType": "git"}, {"version": "37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea", "lessThan": "ac39fd4a757584d78ed062d4f6fd913f83bd98b5", "status": "affected", "versionType": "git"}, {"version": "37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea", "lessThan": "141d34391abbb315d68556b7c67ad97885407547", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/sched/sch_hfsc.c"], "versions": [{"version": "5.0", "status": "affected"}, {"version": "0", "lessThan": "5.0", "status": "unaffected", "versionType": "semver"}, {"version": "5.4.294", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.238", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.182", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.138", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.90", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.28", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.14.6", "lessThanOrEqual": "6.14.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.15", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.0", "versionEndExcluding": "5.4.294"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.0", "versionEndExcluding": "5.10.238"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.0", "versionEndExcluding": "5.15.182"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.0", "versionEndExcluding": "6.1.138"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.0", "versionEndExcluding": "6.6.90"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.0", "versionEndExcluding": "6.12.28"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.0", "versionEndExcluding": "6.14.6"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.0", "versionEndExcluding": "6.15"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/273bbcfa53541cde38b2003ad88a59b770306421"}, {"url": "https://git.kernel.org/stable/c/e0cf8ee23e1915431f262a7b2dee0c7a7d699af0"}, {"url": "https://git.kernel.org/stable/c/e3e949a39a91d1f829a4890e7dfe9417ac72e4d0"}, {"url": "https://git.kernel.org/stable/c/8df7d37d626430035b413b97cee18396b3450bef"}, {"url": "https://git.kernel.org/stable/c/6082a87af4c52f58150d40dec1716011d871ac21"}, {"url": "https://git.kernel.org/stable/c/2e7093c7a8aba5d4f8809f271488e5babe75e202"}, {"url": "https://git.kernel.org/stable/c/ac39fd4a757584d78ed062d4f6fd913f83bd98b5"}, {"url": "https://git.kernel.org/stable/c/141d34391abbb315d68556b7c67ad97885407547"}], "title": "net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"}, {"url": "https://lists.debian.org/debian-lts-announce/2025/08/msg00010.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T19:57:02.260Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-37890", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-06-10T20:42:08.844756Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-11T18:44:19.853Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"}, {"url": "https://lists.debian.org/debian-lts-announce/2025/08/msg00010.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T19:57:02.260Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-37890", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-06-10T20:42:08.844756Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-11T17:39:06.216Z"}}], "cna": {"title": "net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea", "lessThan": "273bbcfa53541cde38b2003ad88a59b770306421", "versionType": "git"}, {"status": "affected", "version": "37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea", "lessThan": "e0cf8ee23e1915431f262a7b2dee0c7a7d699af0", "versionType": "git"}, {"status": "affected", "version": "37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea", "lessThan": "e3e949a39a91d1f829a4890e7dfe9417ac72e4d0", "versionType": "git"}, {"status": "affected", "version": "37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea", "lessThan": "8df7d37d626430035b413b97cee18396b3450bef", "versionType": "git"}, {"status": "affected", "version": "37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea", "lessThan": "6082a87af4c52f58150d40dec1716011d871ac21", "versionType": "git"}, {"status": "affected", "version": "37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea", "lessThan": "2e7093c7a8aba5d4f8809f271488e5babe75e202", "versionType": "git"}, {"status": "affected", "version": "37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea", "lessThan": "ac39fd4a757584d78ed062d4f6fd913f83bd98b5", "versionType": "git"}, {"status": "affected", "version": "37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea", "lessThan": "141d34391abbb315d68556b7c67ad97885407547", "versionType": "git"}], "programFiles": ["net/sched/sch_hfsc.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.0"}, {"status": "unaffected", "version": "0", "lessThan": "5.0", "versionType": "semver"}, {"status": "unaffected", "version": "5.4.294", "versionType": "semver", "lessThanOrEqual": "5.4.*"}, {"status": "unaffected", "version": "5.10.238", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.182", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.138", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.90", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.28", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.14.6", "versionType": "semver", "lessThanOrEqual": "6.14.*"}, {"status": "unaffected", "version": "6.15", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/sched/sch_hfsc.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/273bbcfa53541cde38b2003ad88a59b770306421"}, {"url": "https://git.kernel.org/stable/c/e0cf8ee23e1915431f262a7b2dee0c7a7d699af0"}, {"url": "https://git.kernel.org/stable/c/e3e949a39a91d1f829a4890e7dfe9417ac72e4d0"}, {"url": "https://git.kernel.org/stable/c/8df7d37d626430035b413b97cee18396b3450bef"}, {"url": "https://git.kernel.org/stable/c/6082a87af4c52f58150d40dec1716011d871ac21"}, {"url": "https://git.kernel.org/stable/c/2e7093c7a8aba5d4f8809f271488e5babe75e202"}, {"url": "https://git.kernel.org/stable/c/ac39fd4a757584d78ed062d4f6fd913f83bd98b5"}, {"url": "https://git.kernel.org/stable/c/141d34391abbb315d68556b7c67ad97885407547"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc\n\nAs described in Gerrard's report [1], we have a UAF case when an hfsc class\nhas a netem child qdisc. The crux of the issue is that hfsc is assuming\nthat checking for cl->qdisc->q.qlen == 0 guarantees that it hasn't inserted\nthe class in the vttree or eltree (which is not true for the netem\nduplicate case).\n\nThis patch checks the n_active class variable to make sure that the code\nwon't insert the class in the vttree or eltree twice, catering for the\nreentrant case.\n\n[1] https://lore.kernel.org/netdev/CAHcdcOm+03OD2j6R0=YHKqmy=VgJ8xEOKuP6c7mSgnp-TEJJbw@mail.gmail.com/"}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.4.294", "versionStartIncluding": "5.0"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.238", "versionStartIncluding": "5.0"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.182", "versionStartIncluding": "5.0"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.138", "versionStartIncluding": "5.0"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.90", "versionStartIncluding": "5.0"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.28", "versionStartIncluding": "5.0"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.14.6", "versionStartIncluding": "5.0"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.15", "versionStartIncluding": "5.0"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-07-30T05:49:42.072Z"}}}, "cveMetadata": {"cveId": "CVE-2025-37890", "state": "PUBLISHED", "dateUpdated": "2026-07-30T05:49:42.072Z", "dateReserved": "2025-04-16T04:51:23.963Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2025-05-16T13:01:12.798Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/sched/sch_hfsc.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "273bbcfa53541cde38b2003ad88a59b770306421", "status": "affected", "version": "37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea", "versionType": "git"}, {"lessThan": "e0cf8ee23e1915431f262a7b2dee0c7a7d699af0", "status": "affected", "version": "37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea", "versionType": "git"}, {"lessThan": "e3e949a39a91d1f829a4890e7dfe9417ac72e4d0", "status": "affected", "version": "37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea", "versionType": "git"}, {"lessThan": "8df7d37d626430035b413b97cee18396b3450bef", "status": "affected", "version": "37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea", "versionType": "git"}, {"lessThan": "6082a87af4c52f58150d40dec1716011d871ac21", "status": "affected", "version": "37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea", "versionType": "git"}, {"lessThan": "2e7093c7a8aba5d4f8809f271488e5babe75e202", "status": "affected", "version": "37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea", "versionType": "git"}, {"lessThan": "ac39fd4a757584d78ed062d4f6fd913f83bd98b5", "status": "affected", "version": "37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea", "versionType": "git"}, {"lessThan": "141d34391abbb315d68556b7c67ad97885407547", "status": "affected", "version": "37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/sched/sch_hfsc.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.0"}, {"lessThan": "5.0", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.294", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.238", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.182", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.138", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.90", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.28", "versionType": "semver"}, {"lessThanOrEqual": "6.14.*", "status": "unaffected", "version": "6.14.6", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.15", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "DEC27C91-8035-49D5-8C57-B8F8541B23F7", "versionEndExcluding": "5.4.294", "versionStartIncluding": "5.0.1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "0DAAEF7F-D560-47FC-8B65-20404DB82432", "versionEndExcluding": "5.10.238", "versionStartIncluding": "5.5", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "57E76AE8-79D9-4EC8-9845-9A86B1ED152E", "versionEndExcluding": "5.15.182", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "B6266F82-46B4-4D38-AC4A-54C92A1DFAB2", "versionEndExcluding": "6.1.138", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "2BE1DB09-2D62-4C63-AF19-947300669741", "versionEndExcluding": "6.6.90", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "5082CE19-0F3D-4521-AB3E-810D8255F500", "versionEndExcluding": "6.12.28", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "19E5095E-5950-43EA-8E78-FC860855293F", "versionEndExcluding": "6.14.6", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:5.0:-:*:*:*:*:*:*", "matchCriteriaId": "1D0FE595-0CFE-4491-808B-CEF691CE7B0A", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:5.0:rc3:*:*:*:*:*:*", "matchCriteriaId": "963CFC36-FBAD-465F-9891-CDBBF962DFDD", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:5.0:rc4:*:*:*:*:*:*", "matchCriteriaId": "1B084A7A-6047-4804-9395-6000E4A43828", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:5.0:rc5:*:*:*:*:*:*", "matchCriteriaId": "C3430640-AC87-44BF-ABF5-09E0A97E3758", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:5.0:rc6:*:*:*:*:*:*", "matchCriteriaId": "FDF49B77-4688-4908-9239-89B729456D22", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:5.0:rc7:*:*:*:*:*:*", "matchCriteriaId": "77F342FB-3D7B-4EAE-BF8B-57B7B860BAFD", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:5.0:rc8:*:*:*:*:*:*", "matchCriteriaId": "47D61679-6515-4E18-83C7-A71982CCD83C", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc1:*:*:*:*:*:*", "matchCriteriaId": "8D465631-2980-487A-8E65-40AE2B9F8ED1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc2:*:*:*:*:*:*", "matchCriteriaId": "4C9D071F-B28E-46EC-AC61-22B913390211", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc3:*:*:*:*:*:*", "matchCriteriaId": "13FC0DDE-E513-465E-9E81-515702D49B74", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc4:*:*:*:*:*:*", "matchCriteriaId": "8C7B5B0E-4EEB-48F5-B4CF-0935A7633845", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*", "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc\n\nAs described in Gerrard's report [1], we have a UAF case when an hfsc class\nhas a netem child qdisc. The crux of the issue is that hfsc is assuming\nthat checking for cl->qdisc->q.qlen == 0 guarantees that it hasn't inserted\nthe class in the vttree or eltree (which is not true for the netem\nduplicate case).\n\nThis patch checks the n_active class variable to make sure that the code\nwon't insert the class in the vttree or eltree twice, catering for the\nreentrant case.\n\n[1] https://lore.kernel.org/netdev/CAHcdcOm+03OD2j6R0=YHKqmy=VgJ8xEOKuP6c7mSgnp-TEJJbw@mail.gmail.com/"}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net_sched: hfsc: corrige una vulnerabilidad UAF en la clase con netem como qdisc hijo Como se describe en el informe de Gerrard [1], tenemos un caso UAF cuando una clase hfsc tiene una qdisc hijo netem. El quid de la cuesti\u00f3n es que hfsc asume que la comprobaci\u00f3n de cl->qdisc->q.qlen == 0 garantiza que no ha insertado la clase en vttree o eltree (lo que no es cierto para el caso de duplicado de netem). Este parche comprueba la variable de clase n_active para asegurarse de que el c\u00f3digo no inserte la clase en vttree o eltree dos veces, atendiendo al caso reentrante. [1] https://lore.kernel.org/netdev/CAHcdcOm+03OD2j6R0=YHKqmy=VgJ8xEOKuP6c7mSgnp-TEJJbw@mail.gmail.com/"}], "id": "CVE-2025-37890", "lastModified": "2026-07-30T06:22:28.833", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-37890", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-06-10T20:42:08.844756Z", "version": "2.0.3"}}]}, "published": "2025-05-16T13:15:52.437", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/141d34391abbb315d68556b7c67ad97885407547"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/273bbcfa53541cde38b2003ad88a59b770306421"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/2e7093c7a8aba5d4f8809f271488e5babe75e202"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/6082a87af4c52f58150d40dec1716011d871ac21"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/8df7d37d626430035b413b97cee18396b3450bef"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ac39fd4a757584d78ed062d4f6fd913f83bd98b5"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/e0cf8ee23e1915431f262a7b2dee0c7a7d699af0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/e3e949a39a91d1f829a4890e7dfe9417ac72e4d0"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List"], "url": "https://lists.debian.org/debian-lts-announce/2025/08/msg00010.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List"], "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc", "id": "2366848", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2366848"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.7", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "details": ["In the Linux kernel, the following vulnerability has been resolved:\nnet_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc\nAs described in Gerrard's report [1], we have a UAF case when an hfsc class\nhas a netem child qdisc. The crux of the issue is that hfsc is assuming\nthat checking for cl->qdisc->q.qlen == 0 guarantees that it hasn't inserted\nthe class in the vttree or eltree (which is not true for the netem\nduplicate case).\nThis patch checks the n_active class variable to make sure that the code\nwon't insert the class in the vttree or eltree twice, catering for the\nreentrant case.\n[1] https://lore.kernel.org/netdev/CAHcdcOm+03OD2j6R0=YHKqmy=VgJ8xEOKuP6c7mSgnp-TEJJbw@mail.gmail.com/"], "name": "CVE-2025-37890", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Under investigation", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Under investigation", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Under investigation", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-05-16T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-37890\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-37890\nhttps://lore.kernel.org/linux-cve-announce/2025051617-CVE-2025-37890-437b@gregkh/T"], "statement": "A use-after-free vulnerability in HFSC qdisc when used with netem as child could lead to kernel panic due to incorrect queue state assumptions. Exploitable only in specific configurations and requires local access with control over qdisc setup.", "threat_severity": "Moderate"}

{"created": "2025-06-23T19:32:00.277603+00:00", "updated": "2025-06-23T19:32:00.277650+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}