CVERadar
MEDIUM · CVSS 3.1 5.5Public PoCEPSS 0.52% (p43)Threat level 32

CVE-2025-38001: CVE-2025-38001: In the Linux kernel, the following vulnerability has been resolved: net_sched: hfsc: Addr…

linux · linux kernel · NVD published 2025-06-06 · posted 2025-07-11 · last modified 2026-10-16

What it is

In the Linux kernel, the following vulnerability has been resolved: net_sched: hfsc: Address reentrant enqueue adding class to eltree twice Savino says: "We are writing to report that this recent patch (141d34391abbb315d68556b7c67ad97885407547) [1] can be bypassed, and a UAF can still occur when HFSC is utilized with NETEM. The patch only checks the cl->cl_nactive field to determine whether it is the first insertion or not [2], but this field is only incremented by init_vf [3]. By using HFSC_RSC (which uses init_ed) [4], it is possible to bypass the check and insert the class twice in the eltree. Under normal conditions, this would lead to an infinite loop in hfsc_dequeue for the reasons we already explained in this report [5]. However, if TBF is added as root qdisc and it is configured with a very low rate, it can be utilized to prevent packets from being dequeued. This behavior can be exploited to perform subsequent insertions in the HFSC eltree and cause a UAF." To fix both the UAF and the infinite loop, with netem as an hfsc child, check explicitly in hfsc_enqueue whether the class is already in the eltree whenever the HFSC_RSC flag is set. [1] https://web.git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=141d34391abbb315d68556b7c67ad97885407547 [2] https://elixir.bootlin.com/linux/v6.15-rc5/source/net/sched/sch_hfsc.c#L1572 [3] https://elixir.bootlin.com/linux/v6.15-rc5/source/net/sched/sch_hfsc.c#L677 [4] https://elixir.bootlin.com/linux/v6.15-rc5/source/net/sched/sch_hfsc.c#L1574 [5] https://lore.kernel.org/netdev/8DuRWwfqjoRDLDmBMlIfbrsZg9Gx50DHJc1ilxsEBNe2D6NMoigR_eIRIG0LOjMc3r10nUUZtArXx4oZBIdUfZQrwjcQhdinnMis_0G7VEk=@willsroot.io/T/#u

WeaknessCWE-835
CVSS vectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (source: [email protected])
ATT&CK tacticsn/a

Exploitation evidence

First exploit evidence seen: 2025-07-11 (earliest date across the sources below).

Exploited in the wild

No source on this site lists in-the-wild exploitation yet (CISA KEV, VulnCheck KEV).

Public exploit code

GitHub proof-of-concept repositories

4 public repositories from 4 accounts, first seen 2025-07-11. Most starred: 0xdevil/CVE-2025-38001 (90 stars), view repository.

Verify before running: public PoCs can be malicious. Read the code and only run it in an isolated lab. A PoC means exploit code is public, not that this CVE is exploited in the wild.

Sources: nomi-sec/PoC-in-GitHub.

How to fix it

Fixed versions

  • linux linux kernel: upgrade to 5.4.294 or later (affected from 5.0.1)
  • linux linux kernel: upgrade to 5.10.238 or later (affected from 5.5)
  • linux linux kernel: upgrade to 5.15.185 or later (affected from 5.11)
  • linux linux kernel: upgrade to 6.1.141 or later (affected from 5.16)
  • linux linux kernel: upgrade to 6.6.93 or later (affected from 6.2)
  • linux linux kernel: upgrade to 6.12.32 or later (affected from 6.7)
  • linux linux kernel: upgrade to 6.14.10 or later (affected from 6.13)
  • linux linux kernel: upgrade to 6.15.1 or later (affected from 6.15)

Derived from the NVD CPE configuration (versionEndExcluding / versionEndIncluding). Always confirm with the vendor advisory.

Vendor advisories and patches

Detection Generic guidance

    Response checklist Generic guidance

    1. Inventory: find every instance of the affected product and version (include internet-facing and forgotten ones).
    2. Patch or mitigate per the vendor advisory; if you cannot patch, remove internet exposure or apply the vendor workaround.
    3. Assume compromise if the system was exposed before patching: hunt for the indicators in the advisory and review logs back to the disclosure date.
    4. Rotate credentials and secrets stored on or used by the affected system if compromise cannot be ruled out.

    Sources