In the Linux kernel, the following vulnerability has been resolved:
net_sched: hfsc: Fix a UAF vulnerability in class handling
This patch fixes a Use-After-Free vulnerability in the HFSC qdisc class handling. The issue occurs due to a time-of-check/time-of-use condition in hfscchangeclass() when working with certain child qdiscs like netem or codel.
The vulnerability works as follows: 1. hfscchangeclass() checks if a class has packets (q.qlen != 0) 2. It then calls qdiscpeeklen(), which for certain qdiscs (e.g., codel, netem) might drop packets and empty the queue 3. The code continues assuming the queue is still non-empty, adding the class to vttree 4. This breaks HFSC scheduler assumptions that only non-empty classes are in vttree 5. Later, when the class is destroyed, this can lead to a Use-After-Free
The fix adds a second queue length check after qdiscpeeklen() to verify the queue wasn't emptied.
[
{
"id": "CVE-2025-37797-0c4d62e7",
"digest": {
"line_hashes": [
"116774371504565292858665147305103198354",
"35668054500155974493822846757397149292",
"278717680170498410882053399593223794207",
"315274350575216484126020941059969594756",
"235062665193017946791770110313805876020",
"219028781839135057110235906423901082200",
"247926000919619498849747154442896235086",
"312945104365964501161219168508108959630",
"253537975827251206925646873125489058891"
],
"threshold": 0.9
},
"deprecated": false,
"target": {
"file": "net/sched/sch_hfsc.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@28b09a067831f7317c3841812276022d6c940677",
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2025-37797-0f0c538c",
"digest": {
"line_hashes": [
"116774371504565292858665147305103198354",
"35668054500155974493822846757397149292",
"278717680170498410882053399593223794207",
"315274350575216484126020941059969594756",
"235062665193017946791770110313805876020",
"219028781839135057110235906423901082200",
"247926000919619498849747154442896235086",
"312945104365964501161219168508108959630",
"253537975827251206925646873125489058891"
],
"threshold": 0.9
},
"deprecated": false,
"target": {
"file": "net/sched/sch_hfsc.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@20d584a33e480ae80d105f43e0e7b56784da41b9",
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2025-37797-1d0cc1cc",
"digest": {
"length": 3543.0,
"function_hash": "30160922458947511569275561661645841007"
},
"deprecated": false,
"target": {
"file": "net/sched/sch_hfsc.c",
"function": "hfsc_change_class"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@39b9095dd3b55d9b2743df038c32138efa34a9de",
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2025-37797-21551726",
"digest": {
"length": 3515.0,
"function_hash": "152989094364218713223624618920794444300"
},
"deprecated": false,
"target": {
"file": "net/sched/sch_hfsc.c",
"function": "hfsc_change_class"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@86cd4641c713455a4f1c8e54c370c598c2b1cee0",
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2025-37797-24fe3cdd",
"digest": {
"line_hashes": [
"116774371504565292858665147305103198354",
"35668054500155974493822846757397149292",
"278717680170498410882053399593223794207",
"315274350575216484126020941059969594756",
"235062665193017946791770110313805876020",
"219028781839135057110235906423901082200",
"247926000919619498849747154442896235086",
"312945104365964501161219168508108959630",
"253537975827251206925646873125489058891"
],
"threshold": 0.9
},
"deprecated": false,
"target": {
"file": "net/sched/sch_hfsc.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3aa852e3605000d5c47035c3fc3a986d14ccfa9f",
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2025-37797-2e16c525",
"digest": {
"line_hashes": [
"116774371504565292858665147305103198354",
"35668054500155974493822846757397149292",
"278717680170498410882053399593223794207",
"315274350575216484126020941059969594756",
"235062665193017946791770110313805876020",
"219028781839135057110235906423901082200",
"247926000919619498849747154442896235086",
"312945104365964501161219168508108959630",
"253537975827251206925646873125489058891"
],
"threshold": 0.9
},
"deprecated": false,
"target": {
"file": "net/sched/sch_hfsc.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@39b9095dd3b55d9b2743df038c32138efa34a9de",
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2025-37797-33ffefe3",
"digest": {
"line_hashes": [
"116774371504565292858665147305103198354",
"35668054500155974493822846757397149292",
"278717680170498410882053399593223794207",
"315274350575216484126020941059969594756",
"235062665193017946791770110313805876020",
"219028781839135057110235906423901082200",
"247926000919619498849747154442896235086",
"312945104365964501161219168508108959630",
"253537975827251206925646873125489058891"
],
"threshold": 0.9
},
"deprecated": false,
"target": {
"file": "net/sched/sch_hfsc.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bb583c88d23b72d8d16453d24856c99bd93dadf5",
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2025-37797-57812b50",
"digest": {
"length": 3515.0,
"function_hash": "152989094364218713223624618920794444300"
},
"deprecated": false,
"target": {
"file": "net/sched/sch_hfsc.c",
"function": "hfsc_change_class"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bb583c88d23b72d8d16453d24856c99bd93dadf5",
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2025-37797-5a6b37c3",
"digest": {
"length": 3543.0,
"function_hash": "30160922458947511569275561661645841007"
},
"deprecated": false,
"target": {
"file": "net/sched/sch_hfsc.c",
"function": "hfsc_change_class"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fcc8ede663569c704fb00a702973bd6c00373283",
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2025-37797-6099b47a",
"digest": {
"length": 3515.0,
"function_hash": "152989094364218713223624618920794444300"
},
"deprecated": false,
"target": {
"file": "net/sched/sch_hfsc.c",
"function": "hfsc_change_class"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3aa852e3605000d5c47035c3fc3a986d14ccfa9f",
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2025-37797-816cc996",
"digest": {
"length": 3543.0,
"function_hash": "30160922458947511569275561661645841007"
},
"deprecated": false,
"target": {
"file": "net/sched/sch_hfsc.c",
"function": "hfsc_change_class"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@28b09a067831f7317c3841812276022d6c940677",
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2025-37797-9252596c",
"digest": {
"length": 3515.0,
"function_hash": "152989094364218713223624618920794444300"
},
"deprecated": false,
"target": {
"file": "net/sched/sch_hfsc.c",
"function": "hfsc_change_class"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3df275ef0a6ae181e8428a6589ef5d5231e58b5c",
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2025-37797-93d37f07",
"digest": {
"line_hashes": [
"116774371504565292858665147305103198354",
"35668054500155974493822846757397149292",
"278717680170498410882053399593223794207",
"315274350575216484126020941059969594756",
"235062665193017946791770110313805876020",
"219028781839135057110235906423901082200",
"247926000919619498849747154442896235086",
"312945104365964501161219168508108959630",
"253537975827251206925646873125489058891"
],
"threshold": 0.9
},
"deprecated": false,
"target": {
"file": "net/sched/sch_hfsc.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3df275ef0a6ae181e8428a6589ef5d5231e58b5c",
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2025-37797-af40b91b",
"digest": {
"length": 3515.0,
"function_hash": "152989094364218713223624618920794444300"
},
"deprecated": false,
"target": {
"file": "net/sched/sch_hfsc.c",
"function": "hfsc_change_class"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@20d584a33e480ae80d105f43e0e7b56784da41b9",
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2025-37797-bdd93eb0",
"digest": {
"line_hashes": [
"116774371504565292858665147305103198354",
"35668054500155974493822846757397149292",
"278717680170498410882053399593223794207",
"315274350575216484126020941059969594756",
"235062665193017946791770110313805876020",
"219028781839135057110235906423901082200",
"247926000919619498849747154442896235086",
"312945104365964501161219168508108959630",
"253537975827251206925646873125489058891"
],
"threshold": 0.9
},
"deprecated": false,
"target": {
"file": "net/sched/sch_hfsc.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@86cd4641c713455a4f1c8e54c370c598c2b1cee0",
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2025-37797-de6ef682",
"digest": {
"line_hashes": [
"116774371504565292858665147305103198354",
"35668054500155974493822846757397149292",
"278717680170498410882053399593223794207",
"315274350575216484126020941059969594756",
"235062665193017946791770110313805876020",
"219028781839135057110235906423901082200",
"247926000919619498849747154442896235086",
"312945104365964501161219168508108959630",
"253537975827251206925646873125489058891"
],
"threshold": 0.9
},
"deprecated": false,
"target": {
"file": "net/sched/sch_hfsc.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fcc8ede663569c704fb00a702973bd6c00373283",
"signature_type": "Line",
"signature_version": "v1"
}
]