CVE-2025-37890: Linux Kernel Use-After-Free Vulnerability

CVE-2025-37890 Overview

CVE-2025-37890 is a use-after-free (UAF) vulnerability [CWE-416] in the Linux kernel's Hierarchical Fair Service Curve (HFSC) packet scheduler. The flaw occurs when an HFSC class is configured with a Network Emulator (netem) qdisc as its child. The HFSC code incorrectly assumes that checking cl->qdisc->q.qlen == 0 guarantees the class has not been inserted into the vttree or eltree. This assumption breaks in the netem duplicate reentrant case, allowing double insertion and subsequent memory corruption.

Affected distributions include upstream Linux and Debian.

Critical Impact
A local user with the CAP_NET_ADMIN capability can trigger memory corruption in the kernel, leading to privilege escalation, information disclosure, or denial of service.

Affected Products

Linux kernel versions preceding stable patches 141d343, 273bbcf, 2e7093c, 6082a87, 8df7d37, ac39fd4, e0cf8ee, and e3e949a
Linux kernel 6.15 release candidates (rc1 through rc4)
Debian Linux 11.0 (LTS)

Discovery Timeline

2025-05-16 - CVE-2025-37890 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-37890

Vulnerability Analysis

The vulnerability resides in the HFSC packet scheduler in net/sched/sch_hfsc.c. HFSC organizes classes in two data structures: the eligible tree (eltree) and the virtual time tree (vttree). The scheduler tracks queue length using cl->qdisc->q.qlen and uses a zero-length check to decide whether a class needs to be inserted into these trees.

When netem is the child qdisc, it can duplicate packets and reenter the enqueue path. During this reentry, the qlen check does not reliably reflect whether the class is already present in the trees. The class ends up inserted twice, corrupting the tree structures and producing dangling references that are later dereferenced.

An attacker with local access and network administration rights can craft a qdisc hierarchy that triggers the reentrant enqueue. Successful exploitation grants elevated kernel privileges on the target host.

Root Cause

The root cause is an incorrect invariant assumption in the HFSC enqueue logic. The code treats cl->qdisc->q.qlen == 0 as proof that the class is absent from vttree and eltree. The netem duplicate feature violates this invariant by re-entering hfsc_enqueue while the class is already tracked. The fix introduces the n_active class variable to explicitly track active insertions and prevent double insertion in reentrant paths.

Attack Vector

Exploitation requires local access to the target host and the CAP_NET_ADMIN capability, which is available inside unprivileged user namespaces on many distributions. The attacker configures an HFSC qdisc with a netem child qdisc set to duplicate packets. Sending traffic through this qdisc triggers reentrant enqueue behavior that corrupts the scheduler trees. The resulting use-after-free enables kernel memory manipulation for privilege escalation.

The vulnerability affects the confidentiality, integrity, and availability of the host. No user interaction is required beyond the attacker's own actions.

See the upstream fix commit for the reference implementation of the n_active tracking variable.

Detection Methods for CVE-2025-37890

Indicators of Compromise

Kernel oops or panic messages referencing hfsc_enqueue, hfsc_dequeue, eltree_insert, or vttree_insert in dmesg or /var/log/kern.log
Unexpected tc qdisc configurations combining hfsc parent classes with netem children on production hosts
KASAN (Kernel Address Sanitizer) reports of use-after-free in net/sched/sch_hfsc.c on instrumented builds

Detection Strategies

Audit running kernel versions across the fleet and compare against the fixed stable branches referenced in the vendor advisories
Monitor process execution for tc qdisc add invocations that attach netem under an hfsc class, particularly by non-root users in containerized environments
Alert on user namespace creation followed by traffic control manipulation, a common pattern for local kernel exploits

Monitoring Recommendations

Enable audit rules on setsockopt, sendmsg, and netlink NETLINK_ROUTE traffic to capture qdisc modifications
Ingest kernel logs into a centralized logging platform and alert on scheduler-related crash signatures
Track container runtime events that grant CAP_NET_ADMIN to workloads, as this capability is a prerequisite for exploitation

How to Mitigate CVE-2025-37890

Immediate Actions Required

Apply the stable kernel updates that include the n_active tracking fix as soon as vendor packages are available
Inventory hosts running kernels in the affected 6.15-rc range and Debian 11 LTS kernels, and prioritize them for patching
Restrict CAP_NET_ADMIN in unprivileged user namespaces where operational requirements permit

Patch Information

The upstream fix is available across multiple stable branches. Reference commits include 141d343, 273bbcf, 2e7093c, 6082a87, 8df7d37, ac39fd4, e0cf8ee, and e3e949a on git.kernel.org. Debian users should follow the Debian LTS Announcement August 2025 and Debian LTS Announcement October 2025 for package versions.

Workarounds

Disable or blacklist the sch_hfsc kernel module on hosts that do not require HFSC scheduling
Prevent creation of unprivileged user namespaces by setting kernel.unprivileged_userns_clone=0 on distributions that expose this sysctl
Avoid configurations that combine hfsc parent qdiscs with netem child qdiscs using packet duplication

bash

# Blacklist the sch_hfsc module
echo "blacklist sch_hfsc" | sudo tee /etc/modprobe.d/blacklist-hfsc.conf
sudo update-initramfs -u

# Disable unprivileged user namespaces (Debian/Ubuntu)
echo "kernel.unprivileged_userns_clone=0" | sudo tee /etc/sysctl.d/99-userns.conf
sudo sysctl -p /etc/sysctl.d/99-userns.conf

# Verify running kernel version
uname -r