net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc
In the Linux kernel, the following vulnerability has been resolved: net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc As described in Gerrard's report [1], we have a UAF case when an hfsc class has a netem child qdisc. The crux of the issue is that hfsc is assuming that checking for cl->qdisc->q.qlen == 0 guarantees that it hasn't inserted the class in the vttree or eltree (which is not true for the netem duplicate case). This patch checks the n_active class variable to make sure that the code won't insert the class in the vttree or eltree twice, catering for the reentrant case. [1] https://lore.kernel.org/netdev/CAHcdcOm+03OD2j6R0=YHKqmy=VgJ8xEOKuP6c7mSgnp-TEJJbw@mail.gmail.com/
- Products
- Kernel
- Affected versions
- Not specified
- Fixed versions
- 5.10.238, 5.15.182, 5.4.294, 6.1.138, 6.12.28, 6.14.6, 6.6.90
- CVEs
- CVE-2025-37890
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 4 Nov 2026, 13:27 UTC · Revision 1
Source evidence
net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc
core-osv · Original sourcePublished 16 May 2025, 13:01 UTC
In the Linux kernel, the following vulnerability has been resolved: net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc As described in Gerrard's report [1], we have a UAF case when an hfsc class has a netem child qdisc. The crux of the issue is that hfsc is assuming that checking for cl->qdisc->q.qlen == 0 guarantees that it hasn't inserted the class in the vttree or eltree (which is not true for the netem duplicate case). This patch checks the n_active class variable to make sure that the code won't insert the class in the vttree or eltree twice, catering for the reentrant case. [1] https://lore.kernel.org/netdev/CAHcdcOm+03OD2j6R0=YHKqmy=VgJ8xEOKuP6c7mSgnp-TEJJbw@mail.gmail.com/
osv:CVE-2025-37890
Kernel
Fixed versions: 5.4.294, 5.10.238, 5.15.182, 6.1.138, 6.6.90, 6.12.28, 6.14.6
Complete source record
{
"id": "684accce094ac0482650a4395ca958636be471b16cd5ebf30baf6a3a6006543b",
"url": "https://osv.dev/vulnerability/CVE-2025-37890",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc",
"summary": "In the Linux kernel, the following vulnerability has been resolved: net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc As described in Gerrard's report [1], we have a UAF case when an hfsc class has a netem child qdisc. The crux of the issue is that hfsc is assuming that checking for cl->qdisc->q.qlen == 0 guarantees that it hasn't inserted the class in the vttree or eltree (which is not true for the netem duplicate case). This patch checks the n_active class variable to make sure that the code won't insert the class in the vttree or eltree twice, catering for the reentrant case. [1] https://lore.kernel.org/netdev/CAHcdcOm+03OD2j6R0=YHKqmy=VgJ8xEOKuP6c7mSgnp-TEJJbw@mail.gmail.com/",
"evidence": "osv:CVE-2025-37890",
"products": [
{
"name": {
"value": "Kernel",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "5.4.294",
"evidence": "/affected/1/ranges"
},
{
"value": "5.10.238",
"evidence": "/affected/1/ranges"
},
{
"value": "5.15.182",
"evidence": "/affected/1/ranges"
},
{
"value": "6.1.138",
"evidence": "/affected/1/ranges"
},
{
"value": "6.6.90",
"evidence": "/affected/1/ranges"
},
{
"value": "6.12.28",
"evidence": "/affected/1/ranges"
},
{
"value": "6.14.6",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
}
],
"severity": "high",
"structured": {
"id": "CVE-2025-37890",
"aliases": [
"CVE-2025-37890"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea"
},
{
"fixed": "273bbcfa53541cde38b2003ad88a59b770306421"
},
{
"fixed": "e0cf8ee23e1915431f262a7b2dee0c7a7d699af0"
},
{
"fixed": "e3e949a39a91d1f829a4890e7dfe9417ac72e4d0"
},
{
"fixed": "8df7d37d626430035b413b97cee18396b3450bef"
},
{
"fixed": "6082a87af4c52f58150d40dec1716011d871ac21"
},
{
"fixed": "2e7093c7a8aba5d4f8809f271488e5babe75e202"
},
{
"fixed": "ac39fd4a757584d78ed062d4f6fd913f83bd98b5"
},
{
"fixed": "141d34391abbb315d68556b7c67ad97885407547"
}
]
}
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-37890.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.0.0"
},
{
"fixed": "5.4.294"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.5.0"
},
{
"fixed": "5.10.238"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.11.0"
},
{
"fixed": "5.15.182"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.16.0"
},
{
"fixed": "6.1.138"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.2.0"
},
{
"fixed": "6.6.90"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.7.0"
},
{
"fixed": "6.12.28"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.13.0"
},
{
"fixed": "6.14.6"
}
]
}
],
"package": {
"name": "Kernel",
"ecosystem": "Linux"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-37890.json"
}
}
],
"modified": "2026-10-28T02:30:36.072560320Z",
"provider": "osv",
"references": [
"https://git.kernel.org/stable/c/141d34391abbb315d68556b7c67ad97885407547",
"https://git.kernel.org/stable/c/273bbcfa53541cde38b2003ad88a59b770306421",
"https://git.kernel.org/stable/c/2e7093c7a8aba5d4f8809f271488e5babe75e202",
"https://git.kernel.org/stable/c/6082a87af4c52f58150d40dec1716011d871ac21",
"https://git.kernel.org/stable/c/8df7d37d626430035b413b97cee18396b3450bef",
"https://git.kernel.org/stable/c/ac39fd4a757584d78ed062d4f6fd913f83bd98b5",
"https://git.kernel.org/stable/c/e0cf8ee23e1915431f262a7b2dee0c7a7d699af0",
"https://git.kernel.org/stable/c/e3e949a39a91d1f829a4890e7dfe9417ac72e4d0",
"https://lists.debian.org/debian-lts-announce/2025/08/msg00010.html",
"https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/37xxx/CVE-2025-37890.json",
"https://nvd.nist.gov/vuln/detail/CVE-2025-37890",
"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
],
"provider_metadata": {
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/37xxx/CVE-2025-37890.json"
}
},
"related_cves": [
{
"value": "CVE-2025-37890",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 503110,
"published_at": "2025-05-16T13:01:12.798+00:00"
}