CVE-2025-38001

What it actually does

Use-after-free in the HFSC qdisc enqueue path when HFSC_RSC is combined with NETEM, allowing a class to be inserted twice into the eltree because the cl_nactive check can be bypassed.

Why it matters to the business

Linux systems using HFSC traffic shaping with NETEM can experience kernel crashes, infinite loops in packet processing, or local privilege escalation, disrupting network services and requiring urgent patching.

How an attack unfolds

An attacker with local access configures an HFSC qdisc with an NETEM child using HFSC_RSC, places TBF as root with a low rate to stall dequeuing, then triggers repeated insertions into the eltree to cause the use-after-free; listed threat actors have used similar kernel scheduler flaws for privilege escalation.

How to fix it

Upgrade the Linux kernel to a version containing commit e5bee633cc276410337d54b99f77fbc1ad8801e5 or later; apply the explicit eltree membership check in hfsc_enqueue when HFSC_RSC is set.

How to confirm the fix worked

Confirm the presence of the fix commit in the running kernel source or binary; test HFSC+NETEM configurations to ensure no duplicate eltree insertions occur and no UAF is triggered.

Typical attack path

1. Obtain local access on a Linux host
2. Create HFSC qdisc with NETEM child and HFSC_RSC flag
3. Attach low-rate TBF as root qdisc
4. Trigger reentrant enqueue operations to insert class twice in eltree
5. Exploit resulting UAF for denial of service or code execution

How to detect it

Review kernel logs for HFSC-related warnings, UAF reports, or infinite loop indicators; inspect qdisc configurations for HFSC+NETEM combinations; correlate with process activity that modifies traffic control settings.

What your security team should do

• Prioritize kernel updates on all systems using HFSC qdiscs within the next 30 days
• Audit network configurations for HFSC combined with NETEM or TBF
• Monitor for new EPSS increases or KEV inclusion
• Apply defense-in-depth by restricting unprivileged qdisc configuration where possible