CVE-2025-38001VulnerabilityPublished 6 Jun 2025Updated 9 Jun 2025

CVE-2025-38001: Linux · Vulnerability

Affects LinuxSource CVE Database V5

Not known to be exploited.

Data as of 25 Oct 2026, 19:02 UTC

Severity

High

Rated High by the CNA (Linux) · No CVSS score from NVD or the CNA

EPSS: 0.5% chance of exploitation in 30 days – higher than 43% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

Exploitation evidence

Disclosed: evidence found.
CVE published 6 Jun 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-25.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

AI-suggested

European organizations should promptly apply the official Linux kernel patches that explicitly check for class presence in the eltree when the HFSC_RSC flag is set, as outlined in the referenced commit (141d34391abbb315d68556b7c67ad97885407547). Network administrators should audit their use of HFSC and NETEM queuing disciplines, especially in combination with TBF configured with low rates, and consider temporarily disabling or replacing these configurations until patches are applied. Monitoring kernel logs for unusual enqueue/dequeue behavior or kernel warnings related to HFSC can help detect exploitation attempts. Organizations running custom or older kernel versions should backport the fix or upgrade to a patched kernel release. Additionally, implementing kernel hardening techniques such as Kernel Address Space Layout Randomization (KASLR), and enabling kernel lockdown features can reduce exploitation risk. Network segmentation and limiting administrative access to systems managing queuing disciplines will further mitigate attack surface. Finally, maintain up-to-date intrusion detection systems capable of identifying anomalous network scheduling behavior.

Description

In the Linux kernel, the following vulnerability has been resolved: net_sched: hfsc: Address reentrant enqueue adding class to eltree twice Savino says: "We are writing to report that this recent patch (141d34391abbb315d68556b7c67ad97885407547) [1] can be bypassed, and a UAF can still occur when HFSC is utilized with NETEM. The patch only checks the cl->cl_nactive field to determine whether it is the first insertion or not [2], but this field is only incremented by init_vf [3]. By using HFSC_RSC (which uses init_ed) [4], it is possible to bypass the check and insert the class twice in the eltree. Under normal conditions, this would lead to an infinite loop in hfsc_dequeue for the reasons we already explained in this report [5]. However, if TBF is added as root qdisc and it is configured with a very low rate, it can be utilized to prevent packets from being dequeued. This behavior can be exploited to perform subsequent insertions in the HFSC eltree and cause a UAF." To fix both the UAF and the infinite loop, with netem as an hfsc child, check explicitly in hfsc_enqueue whether the class is already in the eltree whenever the HFSC_RSC flag is set. [1] https://web.git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=141d34391abbb315d68556b7c67ad97885407547 [2] https://elixir.bootlin.com/linux/v6.15-rc5/source/net/sched/sch_hfsc.c#L1572 [3] https://elixir.bootlin.com/linux/v6.15-rc5/source/net/sched/sch_hfsc.c#L677 [4] https://elixir.bootlin.com/linux/v6.15-rc5/source/net/sched/sch_hfsc.c#L1574 [5] https://lore.kernel.org/netdev/8DuRWwfqjoRDLDmBMlIfbrsZg9Gx50DHJc1ilxsEBNe2D6NMoigR_eIRIG0LOjMc3r10nUUZtArXx4oZBIdUfZQrwjcQhdinnMis_0G7VEk=@willsroot.io/T/#u

Impact

For European organizations, this vulnerability poses significant risks, especially for those relying on Linux-based infrastructure for networking, cloud services, or telecommunications. Exploitation could allow attackers to cause kernel crashes (denial of service) or potentially escalate privileges by executing arbitrary code in kernel space, compromising confidentiality, integrity, and availability of critical systems. Network devices, routers, and servers using HFSC and NETEM queuing disciplines are particularly vulnerable. Given the widespread use of Linux in European data centers, ISPs, and enterprises, successful exploitation could disrupt network traffic management, degrade service quality, or lead to broader system compromises. The complexity of the exploit—requiring specific queuing discipline configurations—may limit widespread exploitation but targeted attacks against critical infrastructure or high-value targets remain a concern. Additionally, the vulnerability could be leveraged in multi-tenant cloud environments common in Europe to escape container or VM isolation.

Summary

CVE-2025-38001 is a vulnerability in the Linux kernel's network scheduler subsystem, specifically within the Hierarchical Fair Service Curve (HFSC) queuing discipline implementation. The issue arises from improper handling of class insertion into the 'eltree' data structure used by HFSC. A recent patch intended to fix a reentrant enqueue problem—where a class could be added twice to the eltree—was found to be incomplete. The patch only checked the 'cl_nactive' field to determine if a class was already inserted, but this field is incremented only by the 'init_vf' function. Attackers can bypass this check by using the HFSC_RSC flag, which relies on 'init_ed' instead, allowing the same class to be inserted twice into the eltree. Under normal conditions, this double insertion would cause an infinite loop during dequeue operations. However, if the Token Bucket Filter (TBF) is configured as the root queuing discipline with a very low rate, it can prevent packets from being dequeued, enabling repeated insertions and ultimately leading to a Use-After-Free (UAF) condition. This UAF can potentially be exploited to execute arbitrary code or cause denial of service by kernel memory corruption. The fix involves explicitly checking in the 'hfsc_enqueue' function whether the class is already present in the eltree when the HFSC_RSC flag is set, thereby preventing double insertion and eliminating both the infinite loop and UAF scenarios. This vulnerability affects Linux kernel versions containing the specified commit hashes prior to the patch. No known exploits are currently reported in the wild.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Description

AI analysisMachine-generated, updated 7 Jul 2025, 20:27 UTC

Technical details

References

Community reviews

Related threats