CVE-2025-37890: Debian Linux

High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days.

In the Linux kernel, the following vulnerability has been resolved: net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc As described in Gerrard's report [1], we have a UAF case when an hfsc class has a netem child qdisc. The crux of the issue is that hfsc is assuming that checking for cl->qdisc->q.qlen == 0 guarantees that it hasn't inserted the class in the vttree or eltree (which is not true for the netem duplicate case). This patch checks the n_active class variable to make sure that the code won't insert the class in the vttree or eltree twice, catering for the reentrant case. [1] https://lore.kernel.org/netdev/CAHcdcOm+03OD2j6R0=YHKqmy=VgJ8xEOKuP6c7mSgnp-TEJJbw@mail.gmail.com/

Affected products

• Debian Debian Linux: version 11.0 only
• Linux Linux Kernel: from 5.0.1, before 5.4.294 (fixed in 5.4.294); from 5.5, before 5.10.238 (fixed in 5.10.238); from 5.11, before 5.15.182 (fixed in 5.15.182); from 5.16, before 6.1.138 (fixed in 6.1.138); from 6.2, before 6.6.90 (fixed in 6.6.90); from 6.7, before 6.12.28 (fixed in 6.12.28); …

Published 2025-05-16. Last modified 2026-07-30.