CVE-2025-38001 Overview
CVE-2025-38001 is a use-after-free (UAF) vulnerability in the Linux kernel's Hierarchical Fair Service Curve (HFSC) network packet scheduler (net/sched/sch_hfsc.c). The flaw bypasses an earlier fix (commit 141d34391abb) that attempted to prevent a class from being inserted into the eltree twice. When HFSC is combined with NETEM as a child qdisc and TBF as the root qdisc with a low rate, a local attacker can trigger reentrant enqueue operations that insert the same class into the eltree multiple times, leading to memory corruption and potential denial of service. The vulnerability is tracked as [CWE-835] (Loop with Unreachable Exit Condition).
Critical Impact
A local, unprivileged user with CAP_NET_ADMIN in a network namespace can trigger a use-after-free or an infinite loop in hfsc_dequeue, resulting in kernel memory corruption or system hang.
Affected Products
- Linux Kernel (multiple versions through 6.15-rc5, including 5.0 release candidates)
- Debian Linux 11.0 (Bullseye)
- Debian Linux 12.0 (Bookworm)
Discovery Timeline
- 2025-06-06 - CVE-2025-38001 published to NVD
- 2026-03-07 - Last updated in NVD database
Technical Details for CVE-2025-38001
Vulnerability Analysis
The vulnerability resides in the HFSC packet scheduler enqueue logic. The previous fix in commit 141d34391abb relied on the cl->cl_nactive field to detect whether a class was already present in the eltree. That field is only incremented by init_vf(), leaving a gap when the HFSC_RSC flag path uses init_ed() instead. An attacker can route an enqueue through the HFSC_RSC branch to bypass the duplicate-insertion check and add the class to the eltree twice.
Once the class exists twice in the red-black tree used by HFSC, subsequent operations on the corrupted tree produce inconsistent state. Under normal conditions this results in an infinite loop in hfsc_dequeue(). When TBF is configured as the root qdisc with a very low rate, packets do not get dequeued, allowing the attacker to perform repeated insertions and free the underlying class memory while references remain in the tree. This produces a use-after-free.
Root Cause
The root cause is an incomplete guard against reentrant enqueue. The cl_nactive counter does not cover the HFSC_RSC code path, so a class can be inserted into the eltree without the counter reflecting its presence. The fix explicitly checks whether the class is already in the eltree in hfsc_enqueue() whenever HFSC_RSC is set.
Attack Vector
Exploitation requires local access and the ability to configure qdiscs, which typically requires CAP_NET_ADMIN. Unprivileged users in containers or user namespaces that grant network admin capabilities can construct a qdisc hierarchy with HFSC as the parent, NETEM as a child, and TBF as the root with a throttled rate. Triggering enqueue operations through this hierarchy drives the class into a corrupted eltree state. Refer to the System Failure write-up on the rbtree family drama for in-depth exploitation analysis.
No public proof-of-concept code is available in the enriched data. The vulnerability is described in the upstream commit messages referenced under Patch Information.
Detection Methods for CVE-2025-38001
Indicators of Compromise
- Kernel oops or panic messages referencing hfsc_enqueue, hfsc_dequeue, or eltree operations in dmesg and /var/log/kern.log.
- KASAN reports flagging use-after-free in net/sched/sch_hfsc.c on kernels built with sanitizers.
- Sudden CPU saturation in softirq context tied to a process that recently configured HFSC, NETEM, and TBF qdiscs.
Detection Strategies
- Audit tc qdisc configuration changes by monitoring netlink socket activity from non-root processes or containerized workloads.
- Alert on creation of HFSC qdiscs combined with NETEM children and TBF root qdiscs, which is the documented exploitation chain.
- Correlate CAP_NET_ADMIN capability usage in user namespaces with subsequent kernel error events.
Monitoring Recommendations
- Collect kernel ring buffer logs centrally and run rules against hfsc_* and KASAN strings.
- Track auditd events for setsockopt, tc, and nl_sock activity from container workloads.
- Monitor host CPU softirq spikes alongside qdisc configuration timestamps to surface attempted exploitation.
How to Mitigate CVE-2025-38001
Immediate Actions Required
- Apply the upstream kernel patches from the stable trees listed in the kernel.org references and reboot affected hosts.
- For Debian systems, install the kernel updates announced in the Debian LTS Announcement (msg00007) and Debian LTS Announcement (msg00008).
- Restrict CAP_NET_ADMIN inside user namespaces and container runtimes to prevent unprivileged qdisc configuration.
Patch Information
The fix has been merged into multiple stable branches. See the upstream commits including e5bee633cc27, 2c928b3a0b04, and 295f7c579b07. The patch adds an explicit eltree membership check in hfsc_enqueue() when HFSC_RSC is set.
Workarounds
- Blacklist the sch_hfsc kernel module on systems that do not require HFSC scheduling.
- Disable unprivileged user namespaces by setting kernel.unprivileged_userns_clone=0 where the distribution supports it.
- Use seccomp or AppArmor profiles to block the tc and netlink configuration paths inside containers.
# Disable the sch_hfsc module to remove the vulnerable code path
echo "install sch_hfsc /bin/true" | sudo tee /etc/modprobe.d/disable-hfsc.conf
sudo rmmod sch_hfsc 2>/dev/null || true
# Restrict unprivileged user namespaces (Debian/Ubuntu)
sudo sysctl -w kernel.unprivileged_userns_clone=0
echo "kernel.unprivileged_userns_clone=0" | sudo tee -a /etc/sysctl.d/99-hardening.conf
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
