Listen to this Post
The vulnerability is a use-after-free bug in the Linux kernel’s Hierarchical Fair Service Curve (HFSC) network packet scheduling subsystem. The flaw resides in the `hfsc_enqueue()` function. When enqueuing the first packet to an HFSC class, this function incorrectly calls the child queue discipline’s `peek()` operation before incrementing the main queue’s length (sch->q.qlen) and backlog statistics. If the child qdisc uses qdisc_peek_dequeued(), this peek can trigger an immediate dequeue and a potential packet drop. In this event, `qdisc_tree_reduce_backlog()` is called to update the hierarchy, but the HFSC qdisc’s own qlen and backlog counters remain at zero. This inconsistent accounting can leave an empty HFSC class erroneously on the “active” list, leading to a subsequent use-after-free condition when the kernel attempts to manage this logically empty class. The bug affects a wide range of kernel versions, from the v4.10 series through the v5.10 series. The fix involves reordering the code to increment the queue length and backlog before performing the peek operation, ensuring accounting remains consistent.
Platform: Linux Kernel
Version: v4.10-v5.10
Vulnerability: Use-After-Free
Severity: High
Date: 2025-06-06
Prediction: 2025-09-15
What Undercode Say:
`zypper in -t patch`
`SUSE-2025-3222=1`
How Exploit:
Local Attack Vector
Complexity: Low
Triggers Dequeue Race
Protection from this CVE
Apply Kernel Patch
Update System Packages
Check Vendor Advisory
Impact
Kernel Memory Corruption
Denial of Service
Privilege Escalation
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
