cve/2025/CVE-2025-38001.md

### [CVE-2025-38001](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38001)
![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen)
![](https://img.shields.io/static/v1?label=Version&message=37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Version&message=5.0%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue)

### Description

In the Linux kernel, the following vulnerability has been resolved:net_sched: hfsc: Address reentrant enqueue adding class to eltree twiceSavino says:    "We are writing to report that this recent patch    (141d34391abbb315d68556b7c67ad97885407547) [1]    can be bypassed, and a UAF can still occur when HFSC is utilized with    NETEM.    The patch only checks the cl->cl_nactive field to determine whether    it is the first insertion or not [2], but this field is only    incremented by init_vf [3].    By using HFSC_RSC (which uses init_ed) [4], it is possible to bypass the    check and insert the class twice in the eltree.    Under normal conditions, this would lead to an infinite loop in    hfsc_dequeue for the reasons we already explained in this report [5].    However, if TBF is added as root qdisc and it is configured with a    very low rate,    it can be utilized to prevent packets from being dequeued.    This behavior can be exploited to perform subsequent insertions in the    HFSC eltree and cause a UAF."To fix both the UAF and the infinite loop, with netem as an hfsc child,check explicitly in hfsc_enqueue whether the class is already in the eltreewhenever the HFSC_RSC flag is set.[1] https://web.git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=141d34391abbb315d68556b7c67ad97885407547[2] https://elixir.bootlin.com/linux/v6.15-rc5/source/net/sched/sch_hfsc.c#L1572[3] https://elixir.bootlin.com/linux/v6.15-rc5/source/net/sched/sch_hfsc.c#L677[4] https://elixir.bootlin.com/linux/v6.15-rc5/source/net/sched/sch_hfsc.c#L1574[5] https://lore.kernel.org/netdev/8DuRWwfqjoRDLDmBMlIfbrsZg9Gx50DHJc1ilxsEBNe2D6NMoigR_eIRIG0LOjMc3r10nUUZtArXx4oZBIdUfZQrwjcQhdinnMis_0G7VEk=@willsroot.io/T/#u

### POC

#### Reference
No PoCs from references.

#### Github
- https://github.com/0xdevil/CVE-2025-38001
- https://github.com/PuddinCat/GithubRepoSpider
- https://github.com/khoatran107/cve-2025-38001
- https://github.com/nomi-sec/PoC-in-GitHub
- https://github.com/w4zu/Debian_security
- https://github.com/xairy/linux-kernel-exploitation