CVE-2025-37797: Linux Kernel Use-After-Free Vulnerability

CVE-2025-37797 Overview

CVE-2025-37797 is a Use-After-Free vulnerability [CWE-416] in the Linux kernel's Hierarchical Fair Service Curve (HFSC) queueing discipline (qdisc). The flaw resides in hfsc_change_class() within the net_sched subsystem. A time-of-check/time-of-use (TOCTOU) condition arises when HFSC operates with child qdiscs such as netem or codel that may drop packets during a peek operation. An attacker with local, low-privileged access and the ability to configure traffic control can trigger memory corruption in the kernel scheduler. Successful exploitation can lead to local privilege escalation or kernel-level code execution.

Critical Impact
Local attackers with CAP_NET_ADMIN in a user namespace can trigger a kernel Use-After-Free in the HFSC packet scheduler, potentially achieving privilege escalation to root.

Affected Products

Linux Kernel (multiple branches including 4.14 through 6.15-rc3)
Debian Linux 11.0
Distributions shipping vulnerable kernel builds using the HFSC qdisc

Discovery Timeline

2025-05-02 - CVE-2025-37797 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-37797

Vulnerability Analysis

The HFSC qdisc maintains a virtual time tree (vttree) that must only contain classes with non-empty backlog queues. During class configuration, hfsc_change_class() checks whether the class has queued packets by evaluating q.qlen != 0. It then calls qdisc_peek_len() to inspect the next packet's length. For child qdiscs like codel and netem, the peek operation can invoke packet-dropping logic that empties the underlying queue. The function then continues execution under the false assumption that the queue remains non-empty and inserts the class into the vttree.

This violates a core HFSC invariant, leaving a class registered in the virtual time tree without a valid backlog. When the class is later destroyed, dangling references produce a Use-After-Free condition on freed kernel memory.

Root Cause

The root cause is a classic TOCTOU race between the initial q.qlen check and the state observed after qdisc_peek_len() returns. The intermediate call has side effects on certain child qdiscs, but the caller does not re-validate queue state. The fix introduces a second qdisc_peek_len() follow-up length check to confirm the queue is still populated before touching the vttree.

Attack Vector

Exploitation requires local access and the ability to create and manipulate qdiscs, typically via the tc command from iproute2. On systems permitting unprivileged user namespaces, an attacker can gain CAP_NET_ADMIN inside a namespace and construct an HFSC hierarchy with a codel or netem child. Triggering the peek path against a queue that drops during peek produces the inconsistent state. Freeing and reallocating the class memory enables the Use-After-Free primitive, which can be shaped into arbitrary kernel read/write and privilege escalation.

Refer to the upstream patches at git.kernel.org for the authoritative technical fix.

Detection Methods for CVE-2025-37797

Indicators of Compromise

Unexpected kernel oops or KASAN reports referencing hfsc_change_class, vttree_insert, or qdisc_peek_len in dmesg and journalctl -k output.
Unprivileged processes invoking tc qdisc operations to add HFSC classes with codel or netem children inside user namespaces.
Sudden kernel panics or scheduler-related crashes on hosts running network shaping workloads.

Detection Strategies

Monitor auditd for execve events invoking tc or ip with qdisc add ... hfsc arguments from non-administrative users.
Detect creation of unprivileged user namespaces followed by netlink traffic control operations using eBPF-based telemetry.
Alert on kernel ring buffer messages containing UAF signatures such as BUG: KASAN: use-after-free combined with sch_hfsc symbols.

Monitoring Recommendations

Baseline legitimate use of HFSC scheduling on production hosts and treat deviations as investigation candidates.
Forward kernel logs to a central SIEM and build correlation rules for scheduler subsystem crashes.
Track workload processes that combine namespace creation with CAP_NET_ADMIN acquisition.

How to Mitigate CVE-2025-37797

Immediate Actions Required

Apply the latest stable kernel updates from your distribution vendor that include the upstream HFSC fix commits.
Debian users should install updates referenced in Debian LTS Announcement #30 and Debian LTS Announcement #45.
Reboot hosts after patching to load the corrected kernel image.

Patch Information

The upstream fix adds a second queue length verification after qdisc_peek_len() to ensure the queue was not emptied by the peek-side effects before inserting the class into vttree. Multiple stable branch backports are available, including commits 3df275ef, 20d584a3, and fcc8ede6. Refer to the full list of kernel commit references for branch-specific patches.

Workarounds

Disable unprivileged user namespaces by setting kernel.unprivileged_userns_clone=0 where policy permits, reducing the local attack surface.
Restrict CAP_NET_ADMIN to trusted administrative accounts and remove it from container profiles that do not require it.
Blacklist the sch_hfsc kernel module on systems that do not require HFSC scheduling via /etc/modprobe.d/.

bash

# Configuration example
# Disable unprivileged user namespaces (Debian/Ubuntu)
echo 'kernel.unprivileged_userns_clone=0' | sudo tee /etc/sysctl.d/99-hardening.conf
sudo sysctl --system

# Prevent loading of the vulnerable HFSC module where not required
echo 'blacklist sch_hfsc' | sudo tee /etc/modprobe.d/blacklist-hfsc.conf
sudo update-initramfs -u