In the Linux kernel, the following vulnerability has been resolved:
net_sched: hfsc: Fix a UAF vulnerability in class handling
This patch fixes a Use-After-Free vulnerability in the HFSC qdisc class handling. The issue occurs due to a time-of-check/time-of-use condition in hfscchangeclass() when working with certain child qdiscs like netem or codel.
The vulnerability works as follows: 1. hfscchangeclass() checks if a class has packets (q.qlen != 0) 2. It then calls qdiscpeeklen(), which for certain qdiscs (e.g., codel, netem) might drop packets and empty the queue 3. The code continues assuming the queue is still non-empty, adding the class to vttree 4. This breaks HFSC scheduler assumptions that only non-empty classes are in vttree 5. Later, when the class is destroyed, this can lead to a Use-After-Free
The fix adds a second queue length check after qdiscpeeklen() to verify the queue wasn't emptied.
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/37xxx/CVE-2025-37797.json"
}"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-37797.json"
[
{
"signature_version": "v1",
"target": {
"file": "net/sched/sch_hfsc.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3aa852e3605000d5c47035c3fc3a986d14ccfa9f",
"deprecated": false,
"digest": {
"line_hashes": [
"116774371504565292858665147305103198354",
"35668054500155974493822846757397149292",
"278717680170498410882053399593223794207",
"315274350575216484126020941059969594756",
"235062665193017946791770110313805876020",
"219028781839135057110235906423901082200",
"247926000919619498849747154442896235086",
"312945104365964501161219168508108959630",
"253537975827251206925646873125489058891"
],
"threshold": 0.9
},
"id": "CVE-2025-37797-24fe3cdd",
"signature_type": "Line"
},
{
"signature_version": "v1",
"target": {
"file": "net/sched/sch_hfsc.c",
"function": "hfsc_change_class"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3aa852e3605000d5c47035c3fc3a986d14ccfa9f",
"deprecated": false,
"digest": {
"function_hash": "152989094364218713223624618920794444300",
"length": 3515.0
},
"id": "CVE-2025-37797-6099b47a",
"signature_type": "Function"
}
]