In the Linux kernel, the following vulnerability has been resolved:
net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc
As described in Gerrard's report [1], we have a UAF case when an hfsc class has a netem child qdisc. The crux of the issue is that hfsc is assuming that checking for cl->qdisc->q.qlen == 0 guarantees that it hasn't inserted the class in the vttree or eltree (which is not true for the netem duplicate case).
This patch checks the n_active class variable to make sure that the code won't insert the class in the vttree or eltree twice, catering for the reentrant case.
[1] https://lore.kernel.org/netdev/CAHcdcOm+03OD2j6R0=YHKqmy=VgJ8xEOKuP6c7mSgnp-TEJJbw@mail.gmail.com/
[
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 837.0,
"function_hash": "201842321671409097896589737285565885347"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6082a87af4c52f58150d40dec1716011d871ac21",
"target": {
"file": "net/sched/sch_hfsc.c",
"function": "hfsc_enqueue"
},
"id": "CVE-2025-37890-13fc8271"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 837.0,
"function_hash": "201842321671409097896589737285565885347"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2e7093c7a8aba5d4f8809f271488e5babe75e202",
"target": {
"file": "net/sched/sch_hfsc.c",
"function": "hfsc_enqueue"
},
"id": "CVE-2025-37890-18fb0482"
},
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"1944425881276499845167178436236543885",
"58089672174513363692099982885305946121",
"206535731097586499594951547642354040162",
"96936309748482148404739456090566894602"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ac39fd4a757584d78ed062d4f6fd913f83bd98b5",
"target": {
"file": "net/sched/sch_hfsc.c"
},
"id": "CVE-2025-37890-57c9a576"
},
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"1944425881276499845167178436236543885",
"58089672174513363692099982885305946121",
"206535731097586499594951547642354040162",
"96936309748482148404739456090566894602"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6082a87af4c52f58150d40dec1716011d871ac21",
"target": {
"file": "net/sched/sch_hfsc.c"
},
"id": "CVE-2025-37890-58cb8d12"
},
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"1944425881276499845167178436236543885",
"58089672174513363692099982885305946121",
"206535731097586499594951547642354040162",
"96936309748482148404739456090566894602"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2e7093c7a8aba5d4f8809f271488e5babe75e202",
"target": {
"file": "net/sched/sch_hfsc.c"
},
"id": "CVE-2025-37890-6dc344ef"
},
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"1944425881276499845167178436236543885",
"58089672174513363692099982885305946121",
"206535731097586499594951547642354040162",
"96936309748482148404739456090566894602"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e3e949a39a91d1f829a4890e7dfe9417ac72e4d0",
"target": {
"file": "net/sched/sch_hfsc.c"
},
"id": "CVE-2025-37890-7d0576be"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 837.0,
"function_hash": "201842321671409097896589737285565885347"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8df7d37d626430035b413b97cee18396b3450bef",
"target": {
"file": "net/sched/sch_hfsc.c",
"function": "hfsc_enqueue"
},
"id": "CVE-2025-37890-7f0af341"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 837.0,
"function_hash": "201842321671409097896589737285565885347"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e3e949a39a91d1f829a4890e7dfe9417ac72e4d0",
"target": {
"file": "net/sched/sch_hfsc.c",
"function": "hfsc_enqueue"
},
"id": "CVE-2025-37890-825f88e3"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 837.0,
"function_hash": "201842321671409097896589737285565885347"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@273bbcfa53541cde38b2003ad88a59b770306421",
"target": {
"file": "net/sched/sch_hfsc.c",
"function": "hfsc_enqueue"
},
"id": "CVE-2025-37890-deaf403a"
},
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"1944425881276499845167178436236543885",
"58089672174513363692099982885305946121",
"206535731097586499594951547642354040162",
"96936309748482148404739456090566894602"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@273bbcfa53541cde38b2003ad88a59b770306421",
"target": {
"file": "net/sched/sch_hfsc.c"
},
"id": "CVE-2025-37890-ef437bb6"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 837.0,
"function_hash": "201842321671409097896589737285565885347"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ac39fd4a757584d78ed062d4f6fd913f83bd98b5",
"target": {
"file": "net/sched/sch_hfsc.c",
"function": "hfsc_enqueue"
},
"id": "CVE-2025-37890-eff68959"
},
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"1944425881276499845167178436236543885",
"58089672174513363692099982885305946121",
"206535731097586499594951547642354040162",
"96936309748482148404739456090566894602"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8df7d37d626430035b413b97cee18396b3450bef",
"target": {
"file": "net/sched/sch_hfsc.c"
},
"id": "CVE-2025-37890-f4a90399"
}
]