Memory Management Flaw in Linux Kernel Affects HFSC Scheduling

CVE-2025-38001

What is CVE-2025-38001?

A vulnerability in the Linux kernel's HFSC (Hierarchical Fair Service Curve) scheduling can lead to a use-after-free (UAF) scenario when utilizing NETEM (Network Emulator). The vulnerability arises from a flaw in how the system checks for classes already in the eltree during enqueue operations. This specific flaw allows attackers to bypass certain checks by using the HFSC_RSC flag, potentially executing an infinite loop and stalling network packet processing. To mitigate this issue, explicit checks for existing classes in the eltree must be implemented when the HFSC_RSC flag is in use.

References