CVE-2025-38000: Linux Kernel Use-After-Free Vulnerability

CVE-2025-38000 Overview

CVE-2025-38000 is a use-after-free vulnerability [CWE-416] in the Linux kernel's Hierarchical Fair Service Curve (HFSC) packet scheduler (sch_hfsc). The flaw exists in hfsc_enqueue(), which calls a child qdisc's peek() operation before updating sch->q.qlen and sch->qstats.backlog. When the child qdisc uses qdisc_peek_dequeued(), this ordering triggers inconsistent queue accounting and can leave an empty HFSC class on the active list. The condition is exploitable by a local user with CAP_NET_ADMIN within a network namespace to corrupt kernel memory.

Critical Impact
Local attackers can trigger a use-after-free in the kernel scheduler, leading to memory corruption, denial of service, or potential local privilege escalation to root.

Affected Products

Linux kernel 6.15-rc1 through 6.15-rc7
Multiple Linux kernel stable branches prior to the patch commits
Debian Linux 11.0 (addressed via Debian LTS advisories)

Discovery Timeline

2025-06-06 - CVE-2025-38000 published to NVD
2025-12-16 - Last updated in NVD database

Technical Details for CVE-2025-38000

Vulnerability Analysis

The HFSC qdisc implements hierarchical packet scheduling in the Linux network stack. When hfsc_enqueue() receives the first packet for a class, it invokes the child qdisc's peek() operation to inspect the next packet without dequeuing it. The bug stems from the order of operations: sch->q.qlen and sch->qstats.backlog are incremented only after the peek call returns.

If the child qdisc implements peek() via qdisc_peek_dequeued(), the peek path internally performs a dequeue operation. When that dequeue triggers a packet drop, qdisc_tree_reduce_backlog() is called against the parent HFSC qdisc. Because qlen and backlog have not yet been incremented, the accounting underflows or reflects inconsistent state.

The result is an HFSC class that appears active but holds no packets. Subsequent operations on this stale class entry dereference freed memory, producing a use-after-free condition in the kernel scheduler.

Root Cause

The root cause is incorrect ordering of state updates relative to operations that can recursively modify that state. The peek() call has side effects when implemented via qdisc_peek_dequeued(), but hfsc_enqueue() treated it as a non-mutating inspection. The patch reorders the logic so that sch->q.qlen and sch->qstats.backlog are incremented before the child qdisc's peek() is invoked.

Attack Vector

Exploitation requires local access and the ability to configure traffic control qdiscs, typically through CAP_NET_ADMIN within a user or network namespace. Unprivileged users in distributions that allow unprivileged user namespace creation can reach the vulnerable code path. An attacker constructs an HFSC qdisc with a child qdisc using qdisc_peek_dequeued() (such as netem or codel), then enqueues traffic crafted to trigger immediate packet drops during the peek operation. The resulting accounting desynchronization yields a use-after-free that can be groomed for local privilege escalation.

The vulnerability is described in prose only; no public proof-of-concept code is referenced in the advisory data.

Detection Methods for CVE-2025-38000

Indicators of Compromise

Unexpected kernel oops or panic messages referencing hfsc_enqueue, hfsc_dequeue, or qdisc_tree_reduce_backlog in dmesg or /var/log/kern.log
KASAN reports indicating use-after-free in net/sched/sch_hfsc.c
Unprivileged processes creating user namespaces and subsequently invoking tc qdisc add operations with HFSC and dequeued-peek child qdiscs

Detection Strategies

Audit usage of tc (iproute2) by non-administrative users and flag HFSC qdisc configurations paired with netem, codel, or other qdiscs that implement qdisc_peek_dequeued()
Enable kernel address sanitizer (KASAN) in test environments to surface the use-after-free during fuzzing of sch_hfsc
Monitor auditd for setsockopt and netlink RTM_NEWQDISC messages originating from unprivileged user namespaces

Monitoring Recommendations

Forward kernel ring buffer logs to a centralized logging or SIEM platform and alert on crash signatures referencing scheduler functions
Track process execution of tc, ip, and unshare-related binaries by non-root users on production hosts
Inventory kernel versions across the fleet and flag systems running unpatched 6.15-rc builds or stable branches missing the upstream fix commits

How to Mitigate CVE-2025-38000

Immediate Actions Required

Apply the upstream kernel patches referenced in the official commit list, or update to a stable kernel release that includes the fix
For Debian systems, install the kernel updates published in the Debian LTS Announcement (msg00007) and Debian LTS Announcement (msg00008)
Restrict creation of unprivileged user namespaces if not required by workloads, using sysctl kernel.unprivileged_userns_clone=0 on supported distributions

Patch Information

The fix is committed across multiple stable branches. Reference commits include 1034e331, 3f3a22ee, 3f981138, 49b21795, 89c301e9, 93c27694, f1dde3eb, and f9f593e3. The patch moves sch->q.qlen and sch->qstats.backlog increments before the child qdisc's peek() call in hfsc_enqueue().

Workarounds

Disable loading of the sch_hfsc kernel module on systems that do not require HFSC scheduling by adding blacklist sch_hfsc to /etc/modprobe.d/
Limit CAP_NET_ADMIN capability assignment and constrain container runtimes from creating arbitrary qdiscs through seccomp and AppArmor or SELinux profiles
Set kernel.unprivileged_userns_clone=0 to block unprivileged user namespace creation where supported by the distribution

bash

# Configuration example
# Disable unprivileged user namespaces
echo 'kernel.unprivileged_userns_clone=0' | sudo tee /etc/sysctl.d/99-userns.conf
sudo sysctl --system

# Blacklist the HFSC qdisc module if unused
echo 'blacklist sch_hfsc' | sudo tee /etc/modprobe.d/blacklist-hfsc.conf
sudo update-initramfs -u