CVE-2025-37953

What it actually does

NULL pointer dereference in htb_next_rb_node() triggered when htb_deactivate() is called twice due to non-idempotent behavior after qdisc_tree_reduce_backlog(), allowing kernel memory corruption or panic in the HTB scheduler.

Why it matters to the business

Potential system crashes or privilege escalation on Linux hosts using HTB qdisc, increasing downtime and risk of unauthorized access in network-intensive environments; no known ransomware use or CISA KEV listing reduces immediate urgency but low EPSS indicates limited in-the-wild exploitation so far.

How an attack unfolds

An attacker with local access crafts traffic or uses a reproducer to trigger fq_codel_dequeue() paths that call htb_qlen_notify() and htb_deactivate() multiple times, leading to NULL ptr dereference in htb_next_rb_node(); related campaigns involving Linux kernel privilege escalation have targeted similar scheduler flaws.

How to fix it

Upgrade Linux kernel to fixed versions such as 6.1.139 or apply the commit 99ff8a20fd61315bf9ae627440a5ff07d22ee153; for Ubuntu Pro 22.04 LTS use openrefine 3.5.2-1ubuntu0.1~esm1 and for 24.04 LTS use 3.7.7-1ubuntu0.1~esm1.

How to confirm the fix worked

Confirm kernel version matches or exceeds listed fixed releases; test HTB qdisc paths with reproducer to ensure no repeated htb_deactivate() calls or NULL ptr access; review dmesg for absence of htb warnings.

Typical attack path

1. Gain local unprivileged access on affected Linux system
2. Trigger network qdisc operations involving HTB and fq_codel
3. Force repeated htb_deactivate() calls via backlog reduction
4. Induce NULL dereference for denial of service or attempt code execution

How to detect it

Review kernel logs for htb_deactivate warnings or NULL pointer dereferences in sch_htb; correlate with process activity involving network queuing; check for exploitation patterns seen in other Linux kernel privilege escalation campaigns.

What your security team should do

• Prioritize kernel upgrades on internet-facing or multi-tenant systems within 30 days given published date and stable EPSS trend
• Monitor for related Linux kernel privilege escalation activity from known threat actors
• Disable HTB qdisc where not required as temporary mitigation
• Apply updates to openrefine packages on Ubuntu Pro instances