CVE-2025-37797

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: net_sched: hfsc: Fix a UAF vulnerability in class handling This patch fixes a Use-After-Free vulnerability in the HFSC qdisc class handling. The issue occurs due to a time-of-check/time-of-use condition in hfsc_change_class() when working with certain child qdiscs like netem or codel. The vulnerability works as follows: 1. hfsc_change_class() checks if a class has packets (q.qlen != 0) 2. It then calls qdisc_peek_len(), which for certain qdiscs (e.g., codel, netem) might drop packets and empty the queue 3. The code continue...

Affected product and versions

Product

Linux Linux, linux kernel, debian linux

Affected versions

>= 21f4d5cc25ec0e6e8eb8420dd2c399e6d2fc7d14 < 28b09a067831f7317c3841812276022d6c940677, >= 21f4d5cc25ec0e6e8eb8420dd2c399e6d2fc7d14 < 39b9095dd3b55d9b2743df038c32138efa34a9de, >= 21f4d5cc25ec0e6e8eb8420dd2c399e6d2fc7d14 < fcc8ede663569c704fb00a702973bd6c00373283, >= 21f4d5cc25ec0e6e8eb8420dd2c399e6d2fc7d14 < 20d584a33e480ae80d105f43e0e7b56784da41b9, >= 21f4d5cc25ec0e6e8eb8420dd2c399e6d2fc7d14 < 3aa852e3605000d5c47035c3fc3a986d14ccfa9f, >= 21f4d5cc25ec0e6e8eb8420dd2c399e6d2fc7d14 < 86cd4641c713455a4f1c8e54c370c598c2b1cee0, >= 21f4d5cc25ec0e6e8eb8420dd2c399e6d2fc7d14 < bb583c88d23b72d8d16453d24856c99bd93dadf5, >= 21f4d5cc25ec0e6e8eb8420dd2c399e6d2fc7d14 < 3df275ef0a6ae181e8428a6589ef5d5231e58b5c, >= 4.14, >= 4.14.1 < 5.4.293, >= 5.5 < 5.10.237, >= 5.11 < 5.15.181, >= 5.16 < 6.1.136, >= 6.2 < 6.6.89, >= 6.7 < 6.12.26, >= 6.13 < 6.14.5, 4.14, 6.15, 11.0

Fixed versions

5.4.293, 5.10.237, 5.15.181, 6.1.136, 6.6.89, 6.12.26, 6.14.5

Technical data

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-416