In the Linux kernel, the following vulnerability has been resolved:
net_sched: hfsc: Address reentrant enqueue adding class to eltree twice
Savino says: "We are writing to report that this recent patch (141d34391abbb315d68556b7c67ad97885407547) [1] can be bypassed, and a UAF can still occur when HFSC is utilized with NETEM.
The patch only checks the cl->cl_nactive field to determine whether
it is the first insertion or not [2], but this field is only
incremented by init_vf [3].
By using HFSC_RSC (which uses init_ed) [4], it is possible to bypass the
check and insert the class twice in the eltree.
Under normal conditions, this would lead to an infinite loop in
hfsc_dequeue for the reasons we already explained in this report [5].
However, if TBF is added as root qdisc and it is configured with a
very low rate,
it can be utilized to prevent packets from being dequeued.
This behavior can be exploited to perform subsequent insertions in the
HFSC eltree and cause a UAF."
To fix both the UAF and the infinite loop, with netem as an hfsc child, check explicitly in hfscenqueue whether the class is already in the eltree whenever the HFSCRSC flag is set.
[1] https://web.git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=141d34391abbb315d68556b7c67ad97885407547 [2] https://elixir.bootlin.com/linux/v6.15-rc5/source/net/sched/schhfsc.c#L1572 [3] https://elixir.bootlin.com/linux/v6.15-rc5/source/net/sched/schhfsc.c#L677 [4] https://elixir.bootlin.com/linux/v6.15-rc5/source/net/sched/schhfsc.c#L1574 [5] https://lore.kernel.org/netdev/8DuRWwfqjoRDLDmBMlIfbrsZg9Gx50DHJc1ilxsEBNe2D6NMoigReIRIG0LOjMc3r10nUUZtArXx4oZBIdUfZQrwjcQhdinnMis_0G7VEk=@willsroot.io/T/#u
[
{
"signature_version": "v1",
"target": {
"file": "net/sched/sch_hfsc.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2c928b3a0b04a431ffcd6c8b7d88a267124a3a28",
"digest": {
"threshold": 0.9,
"line_hashes": [
"159993602126534430534743289514332542457",
"222234174711825638362449447690221922787",
"173751446400263411680459322889248012335",
"166814907816240822304914056241911092370",
"238954073041164461983203403526372559671",
"326879850330508095129601603997844797795",
"212938697879203120385512072152417687164",
"190385613761423257231335285009612433704",
"121486216432719788387923339476640269046",
"150750003544379010961195319792282685795"
]
},
"deprecated": false,
"id": "CVE-2025-38001-0037f0b8",
"signature_type": "Line"
},
{
"signature_version": "v1",
"target": {
"function": "hfsc_change_class",
"file": "net/sched/sch_hfsc.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@39ed887b1dd2d6b720f87e86692ac3006cc111c8",
"digest": {
"length": 3564.0,
"function_hash": "150900093756966281074857833442084558541"
},
"deprecated": false,
"id": "CVE-2025-38001-0cc96477",
"signature_type": "Function"
},
{
"signature_version": "v1",
"target": {
"function": "hfsc_change_class",
"file": "net/sched/sch_hfsc.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6672e6c00810056acaac019fe26cdc26fee8a66c",
"digest": {
"length": 3592.0,
"function_hash": "84126412105639426644103217037264077757"
},
"deprecated": false,
"id": "CVE-2025-38001-1e9da233",
"signature_type": "Function"
},
{
"signature_version": "v1",
"target": {
"function": "hfsc_change_class",
"file": "net/sched/sch_hfsc.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2f2190ce4ca972051cac6a8d7937448f8cb9673c",
"digest": {
"length": 3564.0,
"function_hash": "150900093756966281074857833442084558541"
},
"deprecated": false,
"id": "CVE-2025-38001-20b4494d",
"signature_type": "Function"
},
{
"signature_version": "v1",
"target": {
"function": "hfsc_enqueue",
"file": "net/sched/sch_hfsc.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@39ed887b1dd2d6b720f87e86692ac3006cc111c8",
"digest": {
"length": 860.0,
"function_hash": "323353997235294627667916388662879703165"
},
"deprecated": false,
"id": "CVE-2025-38001-25f6f140",
"signature_type": "Function"
},
{
"signature_version": "v1",
"target": {
"function": "hfsc_change_class",
"file": "net/sched/sch_hfsc.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a0ec22fa20b252edbe070a9de8501eef63c17ef5",
"digest": {
"length": 3564.0,
"function_hash": "150900093756966281074857833442084558541"
},
"deprecated": false,
"id": "CVE-2025-38001-33008ff5",
"signature_type": "Function"
},
{
"signature_version": "v1",
"target": {
"file": "net/sched/sch_hfsc.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a0ec22fa20b252edbe070a9de8501eef63c17ef5",
"digest": {
"threshold": 0.9,
"line_hashes": [
"159993602126534430534743289514332542457",
"222234174711825638362449447690221922787",
"173751446400263411680459322889248012335",
"166814907816240822304914056241911092370",
"238954073041164461983203403526372559671",
"326879850330508095129601603997844797795",
"212938697879203120385512072152417687164",
"190385613761423257231335285009612433704",
"121486216432719788387923339476640269046",
"150750003544379010961195319792282685795"
]
},
"deprecated": false,
"id": "CVE-2025-38001-484d209c",
"signature_type": "Line"
},
{
"signature_version": "v1",
"target": {
"file": "net/sched/sch_hfsc.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@295f7c579b07b5b7cf2dffe485f71cc2f27647cb",
"digest": {
"threshold": 0.9,
"line_hashes": [
"159993602126534430534743289514332542457",
"222234174711825638362449447690221922787",
"173751446400263411680459322889248012335",
"166814907816240822304914056241911092370",
"238954073041164461983203403526372559671",
"326879850330508095129601603997844797795",
"212938697879203120385512072152417687164",
"190385613761423257231335285009612433704",
"121486216432719788387923339476640269046",
"150750003544379010961195319792282685795"
]
},
"deprecated": false,
"id": "CVE-2025-38001-546dfecf",
"signature_type": "Line"
},
{
"signature_version": "v1",
"target": {
"file": "net/sched/sch_hfsc.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2f2190ce4ca972051cac6a8d7937448f8cb9673c",
"digest": {
"threshold": 0.9,
"line_hashes": [
"159993602126534430534743289514332542457",
"222234174711825638362449447690221922787",
"173751446400263411680459322889248012335",
"166814907816240822304914056241911092370",
"238954073041164461983203403526372559671",
"326879850330508095129601603997844797795",
"212938697879203120385512072152417687164",
"190385613761423257231335285009612433704",
"121486216432719788387923339476640269046",
"150750003544379010961195319792282685795"
]
},
"deprecated": false,
"id": "CVE-2025-38001-671d9df6",
"signature_type": "Line"
},
{
"signature_version": "v1",
"target": {
"function": "hfsc_enqueue",
"file": "net/sched/sch_hfsc.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@295f7c579b07b5b7cf2dffe485f71cc2f27647cb",
"digest": {
"length": 860.0,
"function_hash": "323353997235294627667916388662879703165"
},
"deprecated": false,
"id": "CVE-2025-38001-7795a4cb",
"signature_type": "Function"
},
{
"signature_version": "v1",
"target": {
"function": "hfsc_enqueue",
"file": "net/sched/sch_hfsc.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a0ec22fa20b252edbe070a9de8501eef63c17ef5",
"digest": {
"length": 860.0,
"function_hash": "323353997235294627667916388662879703165"
},
"deprecated": false,
"id": "CVE-2025-38001-8416d26b",
"signature_type": "Function"
},
{
"signature_version": "v1",
"target": {
"function": "hfsc_change_class",
"file": "net/sched/sch_hfsc.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2c928b3a0b04a431ffcd6c8b7d88a267124a3a28",
"digest": {
"length": 3592.0,
"function_hash": "84126412105639426644103217037264077757"
},
"deprecated": false,
"id": "CVE-2025-38001-870502b9",
"signature_type": "Function"
},
{
"signature_version": "v1",
"target": {
"file": "net/sched/sch_hfsc.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@39ed887b1dd2d6b720f87e86692ac3006cc111c8",
"digest": {
"threshold": 0.9,
"line_hashes": [
"159993602126534430534743289514332542457",
"222234174711825638362449447690221922787",
"173751446400263411680459322889248012335",
"166814907816240822304914056241911092370",
"238954073041164461983203403526372559671",
"326879850330508095129601603997844797795",
"212938697879203120385512072152417687164",
"190385613761423257231335285009612433704",
"121486216432719788387923339476640269046",
"150750003544379010961195319792282685795"
]
},
"deprecated": false,
"id": "CVE-2025-38001-90c3c7ce",
"signature_type": "Line"
},
{
"signature_version": "v1",
"target": {
"function": "hfsc_change_class",
"file": "net/sched/sch_hfsc.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@295f7c579b07b5b7cf2dffe485f71cc2f27647cb",
"digest": {
"length": 3564.0,
"function_hash": "150900093756966281074857833442084558541"
},
"deprecated": false,
"id": "CVE-2025-38001-9203524e",
"signature_type": "Function"
},
{
"signature_version": "v1",
"target": {
"file": "net/sched/sch_hfsc.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ac9fe7dd8e730a103ae4481147395cc73492d786",
"digest": {
"threshold": 0.9,
"line_hashes": [
"159993602126534430534743289514332542457",
"222234174711825638362449447690221922787",
"173751446400263411680459322889248012335",
"166814907816240822304914056241911092370",
"238954073041164461983203403526372559671",
"326879850330508095129601603997844797795",
"212938697879203120385512072152417687164",
"190385613761423257231335285009612433704",
"121486216432719788387923339476640269046",
"150750003544379010961195319792282685795"
]
},
"deprecated": false,
"id": "CVE-2025-38001-96fb1896",
"signature_type": "Line"
},
{
"signature_version": "v1",
"target": {
"function": "hfsc_change_class",
"file": "net/sched/sch_hfsc.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ac9fe7dd8e730a103ae4481147395cc73492d786",
"digest": {
"length": 3564.0,
"function_hash": "150900093756966281074857833442084558541"
},
"deprecated": false,
"id": "CVE-2025-38001-9d9c4e0b",
"signature_type": "Function"
},
{
"signature_version": "v1",
"target": {
"function": "hfsc_change_class",
"file": "net/sched/sch_hfsc.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e5bee633cc276410337d54b99f77fbc1ad8801e5",
"digest": {
"length": 3592.0,
"function_hash": "84126412105639426644103217037264077757"
},
"deprecated": false,
"id": "CVE-2025-38001-a2cf20cc",
"signature_type": "Function"
},
{
"signature_version": "v1",
"target": {
"function": "hfsc_enqueue",
"file": "net/sched/sch_hfsc.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2f2190ce4ca972051cac6a8d7937448f8cb9673c",
"digest": {
"length": 860.0,
"function_hash": "323353997235294627667916388662879703165"
},
"deprecated": false,
"id": "CVE-2025-38001-ac63e144",
"signature_type": "Function"
},
{
"signature_version": "v1",
"target": {
"file": "net/sched/sch_hfsc.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6672e6c00810056acaac019fe26cdc26fee8a66c",
"digest": {
"threshold": 0.9,
"line_hashes": [
"159993602126534430534743289514332542457",
"222234174711825638362449447690221922787",
"173751446400263411680459322889248012335",
"166814907816240822304914056241911092370",
"238954073041164461983203403526372559671",
"326879850330508095129601603997844797795",
"212938697879203120385512072152417687164",
"190385613761423257231335285009612433704",
"121486216432719788387923339476640269046",
"150750003544379010961195319792282685795"
]
},
"deprecated": false,
"id": "CVE-2025-38001-b44350ce",
"signature_type": "Line"
},
{
"signature_version": "v1",
"target": {
"file": "net/sched/sch_hfsc.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4e38eaaabfb7fffbb371a51150203e19eee5d70e",
"digest": {
"threshold": 0.9,
"line_hashes": [
"159993602126534430534743289514332542457",
"222234174711825638362449447690221922787",
"173751446400263411680459322889248012335",
"166814907816240822304914056241911092370",
"238954073041164461983203403526372559671",
"326879850330508095129601603997844797795",
"212938697879203120385512072152417687164",
"190385613761423257231335285009612433704",
"121486216432719788387923339476640269046",
"150750003544379010961195319792282685795"
]
},
"deprecated": false,
"id": "CVE-2025-38001-b45bb5ea",
"signature_type": "Line"
},
{
"signature_version": "v1",
"target": {
"function": "hfsc_enqueue",
"file": "net/sched/sch_hfsc.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ac9fe7dd8e730a103ae4481147395cc73492d786",
"digest": {
"length": 860.0,
"function_hash": "323353997235294627667916388662879703165"
},
"deprecated": false,
"id": "CVE-2025-38001-c6f87420",
"signature_type": "Function"
},
{
"signature_version": "v1",
"target": {
"function": "hfsc_enqueue",
"file": "net/sched/sch_hfsc.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6672e6c00810056acaac019fe26cdc26fee8a66c",
"digest": {
"length": 860.0,
"function_hash": "323353997235294627667916388662879703165"
},
"deprecated": false,
"id": "CVE-2025-38001-cc73b608",
"signature_type": "Function"
},
{
"signature_version": "v1",
"target": {
"function": "hfsc_enqueue",
"file": "net/sched/sch_hfsc.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4e38eaaabfb7fffbb371a51150203e19eee5d70e",
"digest": {
"length": 860.0,
"function_hash": "323353997235294627667916388662879703165"
},
"deprecated": false,
"id": "CVE-2025-38001-cd074d32",
"signature_type": "Function"
},
{
"signature_version": "v1",
"target": {
"function": "hfsc_enqueue",
"file": "net/sched/sch_hfsc.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e5bee633cc276410337d54b99f77fbc1ad8801e5",
"digest": {
"length": 860.0,
"function_hash": "323353997235294627667916388662879703165"
},
"deprecated": false,
"id": "CVE-2025-38001-d3eaf237",
"signature_type": "Function"
},
{
"signature_version": "v1",
"target": {
"function": "hfsc_change_class",
"file": "net/sched/sch_hfsc.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4e38eaaabfb7fffbb371a51150203e19eee5d70e",
"digest": {
"length": 3564.0,
"function_hash": "150900093756966281074857833442084558541"
},
"deprecated": false,
"id": "CVE-2025-38001-dfeb2d6a",
"signature_type": "Function"
},
{
"signature_version": "v1",
"target": {
"function": "hfsc_enqueue",
"file": "net/sched/sch_hfsc.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2c928b3a0b04a431ffcd6c8b7d88a267124a3a28",
"digest": {
"length": 860.0,
"function_hash": "323353997235294627667916388662879703165"
},
"deprecated": false,
"id": "CVE-2025-38001-e5af3de1",
"signature_type": "Function"
},
{
"signature_version": "v1",
"target": {
"file": "net/sched/sch_hfsc.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e5bee633cc276410337d54b99f77fbc1ad8801e5",
"digest": {
"threshold": 0.9,
"line_hashes": [
"159993602126534430534743289514332542457",
"222234174711825638362449447690221922787",
"173751446400263411680459322889248012335",
"166814907816240822304914056241911092370",
"238954073041164461983203403526372559671",
"326879850330508095129601603997844797795",
"212938697879203120385512072152417687164",
"190385613761423257231335285009612433704",
"121486216432719788387923339476640269046",
"150750003544379010961195319792282685795"
]
},
"deprecated": false,
"id": "CVE-2025-38001-fc39f0e1",
"signature_type": "Line"
}
]