CVE-2025-37823

7.8 HIGH

Denial of Service

📋 TL;DR

This CVE describes a use-after-free vulnerability in the Linux kernel's HFSC (Hierarchical Fair Service Curve) network scheduler. An attacker could potentially exploit this to cause kernel memory corruption, leading to system crashes or privilege escalation. All Linux systems using the HFSC scheduler are affected.

💻 Affected Systems

Products:

Linux kernel

Versions: Specific affected kernel versions not specified in CVE description, but patches are available in stable kernel trees.

Operating Systems: Linux distributions using vulnerable kernel versions

Default Config Vulnerable: ✅ No

Notes: Only affects systems with HFSC scheduler enabled (CONFIG_NET_SCH_HFSC). Many distributions don't enable this by default.

📦 What is this software?

Debian Linux by Debian

View all CVEs affecting Debian Linux →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic leading to denial of service, or local privilege escalation to root if memory corruption can be controlled to execute arbitrary code.

🟠

Likely Case

System instability, crashes, or denial of service affecting network performance on systems using HFSC scheduling.

🟢

If Mitigated

Minimal impact if systems don't use HFSC scheduler or have proper kernel hardening features enabled.

🌐 Internet-Facing: LOW - This is a local kernel vulnerability requiring local access to exploit.

🏢 Internal Only: MEDIUM - Internal users with shell access could potentially exploit this for privilege escalation or DoS attacks.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: HIGH

No reliable reproducer exists according to the CVE description, making exploitation challenging. Requires local access and HFSC scheduler usage.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Patches available in stable kernel trees (commits: 11bccb054c1462fb069219f8e98e97a5a730758e, 2f46d14919c39528c6e540ebc43f90055993eedc, 68f256305ceb426d545a0dc31f83c2ab1d211a1e, 6ccbda44e2cc3d26fd22af54c650d6d5d801addf, 76c4c22c2437d3d3880efc0f62eca06ef078d290)

Vendor Advisory: https://git.kernel.org/stable/c/11bccb054c1462fb069219f8e98e97a5a730758e

Restart Required: Yes

Instructions:

1. Update to a patched kernel version from your distribution's repositories. 2. Reboot the system to load the new kernel. 3. Verify the patch is applied by checking kernel version or commit hash.

🔧 Temporary Workarounds

Disable HFSC scheduler

linux

Disable the HFSC network scheduler if not required for your system's functionality.

modprobe -r sch_hfsc
echo 'blacklist sch_hfsc' >> /etc/modprobe.d/blacklist.conf

🧯 If You Can't Patch

Disable HFSC scheduler module if not needed
Implement strict access controls to limit local user privileges

🔍 How to Verify

Check if Vulnerable:

Check if HFSC module is loaded: lsmod | grep hfsc. Check kernel version against patched versions.

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version includes the patch commits or is newer than the fixed versions. Check that HFSC module functions normally after patch.

📡 Detection & Monitoring

Log Indicators:

Kernel oops messages in /var/log/kern.log or dmesg
System crashes or unexpected reboots

Network Indicators:

Unusual network scheduling behavior if HFSC is used

SIEM Query:

source="kernel" AND ("Oops" OR "general protection fault" OR "use-after-free")

📊 Metadata

CVE ID: CVE-2025-37823

CVSS v3 Score: 7.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-416

EPSS Score: 0.02% exploit probability (4.6th percentile)

Published: May 8, 2025

Last Updated: November 10, 2025

🔗 References

https://git.kernel.org/stable/c/11bccb054c1462fb069219f8e98e97a5a730758e Patch
https://git.kernel.org/stable/c/2f46d14919c39528c6e540ebc43f90055993eedc Patch
https://git.kernel.org/stable/c/68f256305ceb426d545a0dc31f83c2ab1d211a1e Patch
https://git.kernel.org/stable/c/6ccbda44e2cc3d26fd22af54c650d6d5d801addf Patch
https://git.kernel.org/stable/c/76c4c22c2437d3d3880efc0f62eca06ef078d290 Patch
https://git.kernel.org/stable/c/c6936266f8bf98a53f28ef9a820e6a501e946d09 Patch
https://git.kernel.org/stable/c/c6f035044104c6ff656f4565cd22938dc892528c Patch
https://git.kernel.org/stable/c/da7936518996d290e2fcfcaf6cd7e15bfd87804a Patch
https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html Mailing List,Third Party Advisory
https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html Mailing List,Third Party Advisory