UBUNTU-CVE-2025-37797: Use After Free

Q: Which systems are exposed to this issue?

Systems using an affected Ubuntu kernel package are exposed only where the HFSC traffic-control qdisc is in use and a vulnerable class configuration involves child qdiscs such as netem or codel. The listed package families include ubuntu/linux, ubuntu/linux-azure, ubuntu/linux-aws-fips, ubuntu/linux-azure-fips, ubuntu/linux-gcp-fips, ubuntu/linux-gcp, ubuntu/linux-oracle, and ubuntu/linux-fips.

Q: What access does an attacker need to exploit the vulnerability?

The provided CVSS vector indicates local access and low privileges are required, with no user interaction. Exploitation depends on being able to manipulate the relevant HFSC class and child-qdisc handling.

Q: Are default network configurations affected?

The issue is tied to HFSC qdisc class handling and specific child qdiscs that can empty a queue during qdisc_peek_len(), including codel and netem. The provided data does not establish that this configuration is enabled or reachable by default.

Q: What is the impact if exploitation succeeds?

The flaw can cause a use-after-free when an HFSC class is later destroyed after scheduler state is corrupted. The supplied severity vector rates confidentiality, integrity, and availability impact as high.

Q: What does the fix change?

The fix rechecks the queue length after qdisc_peek_len() returns. This prevents a class whose queue was emptied by that operation from being added to the HFSC virtual-time tree.

Published May 2, 2025

Updated

In the Linux kernel, the following vulnerability has been resolved: netsched: hfsc: Fix a UAF vulnerability in class handling This patch fixes a Use-After-Free vulnerability in the HFSC qdisc class handling. The issue occurs due to a time-of-check/time-of-use condition in hfscchangeclass() when working with certain child qdiscs like netem or codel. The vulnerability works as follows: 1. hfscchangeclass() checks if a class has packets (q.qlen != 0) 2. It then calls qdiscpeeklen(), which for certain qdiscs (e.g., codel, netem) might drop packets and empty the queue 3. The code continues assuming the queue is still non-empty, adding the class to vttree 4. This breaks HFSC scheduler assumptions that only non-empty classes are in vttree 5. Later, when the class is destroyed, this can lead to a Use-After-Free The fix adds a second queue length check after qdiscpeeklen() to verify the queue wasn't emptied.

Affected Software

203 affected componentsFixes available

ubuntu/linux-azure<4.15.0-1191.206~14.04.1

4.15.0-1191.206~14.04.1

ubuntu/linux-aws-hwe<4.15.0-1183.196~16.04.1

4.15.0-1183.196~16.04.1

ubuntu/linux-azure<4.15.0-1191.206~16.04.1

4.15.0-1191.206~16.04.1

ubuntu/linux-gcp<4.15.0-1176.193~16.04.1

4.15.0-1176.193~16.04.1

ubuntu/linux-hwe<4.15.0-240.252~16.04.1

4.15.0-240.252~16.04.1

ubuntu/linux-oracle<4.15.0-1145.156~16.04.1

4.15.0-1145.156~16.04.1

ubuntu/linux-hwe-edge*

ubuntu/linux<4.15.0-240.252

4.15.0-240.252

ubuntu/linux-aws<4.15.0-1183.196

4.15.0-1183.196

ubuntu/linux-aws-5.0*

ubuntu/linux-aws-5.3*

ubuntu/linux-aws-5.4<5.4.0-1149.159~18.04.1

5.4.0-1149.159~18.04.1

ubuntu/linux-azure*

ubuntu/linux-azure-4.15<4.15.0-1191.206

4.15.0-1191.206

ubuntu/linux-azure-5.3*

ubuntu/linux-azure-5.4<5.4.0-1154.161~18.04.1

5.4.0-1154.161~18.04.1

ubuntu/linux-azure-edge*

ubuntu/linux-gcp*

ubuntu/linux-gcp-4.15<4.15.0-1176.193

4.15.0-1176.193

ubuntu/linux-gcp-5.3*

ubuntu/linux-gcp-5.4<5.4.0-1152.161~18.04.1

5.4.0-1152.161~18.04.1

ubuntu/linux-gke-4.15*

ubuntu/linux-gke-5.4*

ubuntu/linux-gkeop-5.4*

ubuntu/linux-hwe*

ubuntu/linux-hwe-5.4<5.4.0-220.240~18.04.1

5.4.0-220.240~18.04.1

ubuntu/linux-hwe-edge*

ubuntu/linux-ibm-5.4<5.4.0-1095.100~18.04.1

5.4.0-1095.100~18.04.1

ubuntu/linux-kvm<4.15.0-1166.171

4.15.0-1166.171

ubuntu/linux-oem*

ubuntu/linux-oracle<4.15.0-1145.156

4.15.0-1145.156

ubuntu/linux-oracle-5.0*

ubuntu/linux-oracle-5.3*

ubuntu/linux-oracle-5.4<5.4.0-1148.158~18.04.1

5.4.0-1148.158~18.04.1

ubuntu/linux-raspi-5.4<5.4.0-1132.145~18.04.1

5.4.0-1132.145~18.04.1

ubuntu/linux-aws-fips<4.15.0-2121.127

4.15.0-2121.127

ubuntu/linux-azure-fips<4.15.0-2100.106

4.15.0-2100.106

ubuntu/linux-fips<4.15.0-1138.149

4.15.0-1138.149

ubuntu/linux-gcp-fips<4.15.0-2084.90

4.15.0-2084.90

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux<5.4.0-220.240

5.4.0-220.240

ubuntu/linux-aws<5.4.0-1149.159

5.4.0-1149.159

ubuntu/linux-aws-5.11*

ubuntu/linux-aws-5.13*

ubuntu/linux-aws-5.15<5.15.0-1088.95~20.04.1

5.15.0-1088.95~20.04.1

ubuntu/linux-aws-5.8*

ubuntu/linux-azure<5.4.0-1154.161

5.4.0-1154.161

ubuntu/linux-azure-5.11*

ubuntu/linux-azure-5.13*

ubuntu/linux-azure-5.15<5.15.0-1094.103~20.04.1

5.15.0-1094.103~20.04.1

ubuntu/linux-azure-5.8*

ubuntu/linux-azure-fde*

ubuntu/linux-bluefield<5.4.0-1108.115

5.4.0-1108.115

ubuntu/linux-gcp<5.4.0-1152.161

5.4.0-1152.161

ubuntu/linux-gcp-5.11*

ubuntu/linux-gcp-5.13*

ubuntu/linux-gcp-5.15<5.15.0-1087.96~20.04.2

5.15.0-1087.96~20.04.2

ubuntu/linux-gcp-5.8*

ubuntu/linux-gke*

ubuntu/linux-gke-5.15*

ubuntu/linux-gkeop*

ubuntu/linux-gkeop-5.15*

ubuntu/linux-hwe-5.11*

ubuntu/linux-hwe-5.13*

ubuntu/linux-hwe-5.15<5.15.0-144.157~20.04.1

5.15.0-144.157~20.04.1

ubuntu/linux-hwe-5.8*

ubuntu/linux-ibm<5.4.0-1095.100

5.4.0-1095.100

ubuntu/linux-ibm-5.15<5.15.0-1080.83~20.04.1

5.15.0-1080.83~20.04.1

ubuntu/linux-intel-5.13*

ubuntu/linux-intel-iotg-5.15<5.15.0-1083.89~20.04.1

5.15.0-1083.89~20.04.1

ubuntu/linux-iot<5.4.0-1053.56

5.4.0-1053.56

ubuntu/linux-kvm<5.4.0-1136.145

5.4.0-1136.145

ubuntu/linux-lowlatency-hwe-5.15<5.15.0-144.157~20.04.1

5.15.0-144.157~20.04.1

ubuntu/linux-nvidia-tegra-5.15<5.15.0-1041.41~20.04.1

5.15.0-1041.41~20.04.1

ubuntu/linux-oem-5.10*

ubuntu/linux-oem-5.13*

ubuntu/linux-oem-5.6*

ubuntu/linux-oracle<5.4.0-1147.157

5.4.0-1147.157

ubuntu/linux-oracle-5.11*

ubuntu/linux-oracle-5.13*

ubuntu/linux-oracle-5.15<5.15.0-1085.91~20.04.3

5.15.0-1085.91~20.04.3

ubuntu/linux-oracle-5.8*

ubuntu/linux-raspi<5.4.0-1132.145

5.4.0-1132.145

ubuntu/linux-raspi2*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.11*

ubuntu/linux-riscv-5.15<5.15.0-1083.87~20.04.1

5.15.0-1083.87~20.04.1

ubuntu/linux-riscv-5.8*

ubuntu/linux-xilinx-zynqmp<5.4.0-1067.71

5.4.0-1067.71

ubuntu/linux-aws-fips<5.4.0-1149.159+fips1

5.4.0-1149.159+fips1

ubuntu/linux-azure-fips<5.4.0-1155.162+fips1

5.4.0-1155.162+fips1

ubuntu/linux-fips<5.4.0-1123.133

5.4.0-1123.133

ubuntu/linux-gcp-fips<5.4.0-1152.161+fips1

5.4.0-1152.161+fips1

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux<5.15.0-144.157

5.15.0-144.157

ubuntu/linux-allwinner-5.19*

ubuntu/linux-aws<5.15.0-1088.95

5.15.0-1088.95

ubuntu/linux-aws-5.19*

ubuntu/linux-aws-6.2*

ubuntu/linux-aws-6.5*

ubuntu/linux-aws-6.8<6.8.0-1033.35~22.04.1

6.8.0-1033.35~22.04.1

ubuntu/linux-azure<5.15.0-1094.103

5.15.0-1094.103

ubuntu/linux-azure-5.19*

ubuntu/linux-azure-6.2*

ubuntu/linux-azure-6.5*

ubuntu/linux-azure-6.8<6.8.0-1034.39~22.04.1

6.8.0-1034.39~22.04.1

ubuntu/linux-azure-fde<5.15.0-1094.103.1

5.15.0-1094.103.1

ubuntu/linux-azure-fde-5.19*

ubuntu/linux-azure-fde-6.2*

ubuntu/linux-gcp<5.15.0-1087.96

5.15.0-1087.96

ubuntu/linux-gcp-5.19*

ubuntu/linux-gcp-6.2*

ubuntu/linux-gcp-6.5*

ubuntu/linux-gcp-6.8<6.8.0-1034.36~22.04.2

6.8.0-1034.36~22.04.2

ubuntu/linux-gke<5.15.0-1085.91

5.15.0-1085.91

ubuntu/linux-gkeop<5.15.0-1070.78

5.15.0-1070.78

ubuntu/linux-hwe-5.19*

ubuntu/linux-hwe-6.2*

ubuntu/linux-hwe-6.5*

ubuntu/linux-hwe-6.8<6.8.0-65.68~22.04.1

6.8.0-65.68~22.04.1

ubuntu/linux-ibm<5.15.0-1080.83

5.15.0-1080.83

ubuntu/linux-ibm-6.8<6.8.0-1030.30~22.04.1

6.8.0-1030.30~22.04.1

ubuntu/linux-intel-iot-realtime*

ubuntu/linux-intel-iotg<5.15.0-1083.89

5.15.0-1083.89

ubuntu/linux-kvm<5.15.0-1084.89

5.15.0-1084.89

ubuntu/linux-lowlatency<5.15.0-144.157

5.15.0-144.157

ubuntu/linux-lowlatency-hwe-5.19*

ubuntu/linux-lowlatency-hwe-6.2*

ubuntu/linux-lowlatency-hwe-6.5*

ubuntu/linux-lowlatency-hwe-6.8<6.8.0-65.68.1~22.04.1

6.8.0-65.68.1~22.04.1

ubuntu/linux-nvidia<5.15.0-1082.83

5.15.0-1082.83

ubuntu/linux-nvidia-6.2*

ubuntu/linux-nvidia-6.5*

ubuntu/linux-nvidia-6.8<6.8.0-1032.35~22.04.1

6.8.0-1032.35~22.04.1

ubuntu/linux-nvidia-tegra<5.15.0-1041.41

5.15.0-1041.41

ubuntu/linux-nvidia-tegra-igx<5.15.0-1030.30

5.15.0-1030.30

ubuntu/linux-oem-5.17*

ubuntu/linux-oem-6.0*

ubuntu/linux-oem-6.1*

ubuntu/linux-oem-6.5*

ubuntu/linux-oracle<5.15.0-1085.91

5.15.0-1085.91

ubuntu/linux-oracle-6.5*

ubuntu/linux-oracle-6.8<6.8.0-1030.31~22.04.1

6.8.0-1030.31~22.04.1

ubuntu/linux-raspi<5.15.0-1083.86

5.15.0-1083.86

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.19*

ubuntu/linux-riscv-6.5*

ubuntu/linux-riscv-6.8<6.8.0-71.71~22.04.1

6.8.0-71.71~22.04.1

ubuntu/linux-starfive-5.19*

ubuntu/linux-starfive-6.2*

ubuntu/linux-starfive-6.5*

ubuntu/linux-xilinx-zynqmp<5.15.0-1052.56

5.15.0-1052.56

ubuntu/linux-bluefield<5.15.0-1072.74

5.15.0-1072.74

ubuntu/linux-intel-iot-realtime<5.15.0-1081.83

5.15.0-1081.83

ubuntu/linux-realtime<5.15.0-1088.97

5.15.0-1088.97

ubuntu/linux-realtime-6.8<6.8.1-1026.27~22.04.1

6.8.1-1026.27~22.04.1

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux-aws-fips<5.15.0-1088.95+fips1

5.15.0-1088.95+fips1

ubuntu/linux-azure-fips<5.15.0-1094.103+fips1

5.15.0-1094.103+fips1

ubuntu/linux-fips<5.15.0-144.157+fips1

5.15.0-144.157+fips1

ubuntu/linux-gcp-fips<5.15.0-1087.96+fips1

5.15.0-1087.96+fips1

ubuntu/linux<6.8.0-71.71

6.8.0-71.71

ubuntu/linux-aws<6.8.0-1033.35

6.8.0-1033.35

ubuntu/linux-azure<6.8.0-1034.39

6.8.0-1034.39

ubuntu/linux-azure-6.11*

ubuntu/linux-azure-nvidia<6.8.0-1022.23

6.8.0-1022.23

ubuntu/linux-gcp<6.8.0-1034.36

6.8.0-1034.36

ubuntu/linux-gcp-6.11*

ubuntu/linux-gcp-6.14<6.14.0-1011.11~24.04.1

6.14.0-1011.11~24.04.1

ubuntu/linux-gke<6.8.0-1029.33

6.8.0-1029.33

ubuntu/linux-gkeop<6.8.0-1016.18

6.8.0-1016.18

ubuntu/linux-hwe-6.11*

ubuntu/linux-ibm<6.8.0-1030.30

6.8.0-1030.30

ubuntu/linux-lowlatency<6.8.0-65.68.1

6.8.0-65.68.1

ubuntu/linux-lowlatency-hwe-6.11*

ubuntu/linux-nvidia<6.8.0-1032.35

6.8.0-1032.35

ubuntu/linux-nvidia-6.11*

ubuntu/linux-nvidia-lowlatency<6.8.0-1032.35.1

6.8.0-1032.35.1

ubuntu/linux-nvidia-tegra<6.8.0-1009.9

6.8.0-1009.9

ubuntu/linux-oem-6.11*

ubuntu/linux-oem-6.8<6.8.0-1032.32

6.8.0-1032.32

ubuntu/linux-oracle<6.8.0-1030.31

6.8.0-1030.31

ubuntu/linux-raspi<6.8.0-1032.36

6.8.0-1032.36

ubuntu/linux-raspi-realtime*

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-xilinx<6.8.0-1017.18

6.8.0-1017.18

ubuntu/linux-raspi-realtime<6.8.0-2028.29

6.8.0-2028.29

ubuntu/linux-realtime<6.8.1-1026.27

6.8.1-1026.27

ubuntu/linux-realtime-6.14<6.14.0-1010.10~24.04.1

6.14.0-1010.10~24.04.1

ubuntu/linux-fips<6.8.0-78.78+fips1

6.8.0-78.78+fips1

ubuntu/linux-azure-fde*

ubuntu/linux-vmware*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 4.15.0-1191.206~14.04.1
Upgrade
Upgrade ubuntu/linux-aws-hwe to a version that resolves this vulnerability.
Fixed in 4.15.0-1183.196~16.04.1
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 4.15.0-1191.206~16.04.1
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 4.15.0-1176.193~16.04.1
Upgrade
Upgrade ubuntu/linux-hwe to a version that resolves this vulnerability.
Fixed in 4.15.0-240.252~16.04.1
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 4.15.0-1145.156~16.04.1
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 4.15.0-240.252
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 4.15.0-1183.196
Upgrade
Upgrade ubuntu/linux-aws-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1149.159~18.04.1
Upgrade
Upgrade ubuntu/linux-azure-4.15 to a version that resolves this vulnerability.
Fixed in 4.15.0-1191.206
Upgrade
Upgrade ubuntu/linux-azure-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1154.161~18.04.1
Upgrade
Upgrade ubuntu/linux-gcp-4.15 to a version that resolves this vulnerability.
Fixed in 4.15.0-1176.193
Upgrade
Upgrade ubuntu/linux-gcp-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1152.161~18.04.1
Upgrade
Upgrade ubuntu/linux-hwe-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-220.240~18.04.1
Upgrade
Upgrade ubuntu/linux-ibm-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1095.100~18.04.1
Upgrade
Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.
Fixed in 4.15.0-1166.171
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 4.15.0-1145.156
Upgrade
Upgrade ubuntu/linux-oracle-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1148.158~18.04.1
Upgrade
Upgrade ubuntu/linux-raspi-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1132.145~18.04.1
Upgrade
Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.
Fixed in 4.15.0-2121.127
Upgrade
Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.
Fixed in 4.15.0-2100.106
Upgrade
Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.
Fixed in 4.15.0-1138.149
Upgrade
Upgrade ubuntu/linux-gcp-fips to a version that resolves this vulnerability.
Fixed in 4.15.0-2084.90
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 5.4.0-220.240
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 5.4.0-1149.159
Upgrade
Upgrade ubuntu/linux-aws-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1088.95~20.04.1
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 5.4.0-1154.161
Upgrade
Upgrade ubuntu/linux-azure-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1094.103~20.04.1
Upgrade
Upgrade ubuntu/linux-bluefield to a version that resolves this vulnerability.
Fixed in 5.4.0-1108.115
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 5.4.0-1152.161
Upgrade
Upgrade ubuntu/linux-gcp-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1087.96~20.04.2
Upgrade
Upgrade ubuntu/linux-hwe-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-144.157~20.04.1
Upgrade
Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.
Fixed in 5.4.0-1095.100
Upgrade
Upgrade ubuntu/linux-ibm-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1080.83~20.04.1
Upgrade
Upgrade ubuntu/linux-intel-iotg-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1083.89~20.04.1
Upgrade
Upgrade ubuntu/linux-iot to a version that resolves this vulnerability.
Fixed in 5.4.0-1053.56
Upgrade
Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.
Fixed in 5.4.0-1136.145
Upgrade
Upgrade ubuntu/linux-lowlatency-hwe-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-144.157~20.04.1
Upgrade
Upgrade ubuntu/linux-nvidia-tegra-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1041.41~20.04.1
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 5.4.0-1147.157
Upgrade
Upgrade ubuntu/linux-oracle-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1085.91~20.04.3
Upgrade
Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.
Fixed in 5.4.0-1132.145
Upgrade
Upgrade ubuntu/linux-riscv-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1083.87~20.04.1
Upgrade
Upgrade ubuntu/linux-xilinx-zynqmp to a version that resolves this vulnerability.
Fixed in 5.4.0-1067.71
Upgrade
Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.
Fixed in 5.4.0-1149.159+fips1
Upgrade
Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.
Fixed in 5.4.0-1155.162+fips1
Upgrade
Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.
Fixed in 5.4.0-1123.133
Upgrade
Upgrade ubuntu/linux-gcp-fips to a version that resolves this vulnerability.
Fixed in 5.4.0-1152.161+fips1
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 5.15.0-144.157
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 5.15.0-1088.95
Upgrade
Upgrade ubuntu/linux-aws-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1033.35~22.04.1
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 5.15.0-1094.103
Upgrade
Upgrade ubuntu/linux-azure-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1034.39~22.04.1
Upgrade
Upgrade ubuntu/linux-azure-fde to a version that resolves this vulnerability.
Fixed in 5.15.0-1094.103.1
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 5.15.0-1087.96
Upgrade
Upgrade ubuntu/linux-gcp-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1034.36~22.04.2
Upgrade
Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.
Fixed in 5.15.0-1085.91
Upgrade
Upgrade ubuntu/linux-gkeop to a version that resolves this vulnerability.
Fixed in 5.15.0-1070.78
Upgrade
Upgrade ubuntu/linux-hwe-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-65.68~22.04.1
Upgrade
Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.
Fixed in 5.15.0-1080.83
Upgrade
Upgrade ubuntu/linux-ibm-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1030.30~22.04.1
Upgrade
Upgrade ubuntu/linux-intel-iotg to a version that resolves this vulnerability.
Fixed in 5.15.0-1083.89
Upgrade
Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.
Fixed in 5.15.0-1084.89
Upgrade
Upgrade ubuntu/linux-lowlatency to a version that resolves this vulnerability.
Fixed in 5.15.0-144.157
Upgrade
Upgrade ubuntu/linux-lowlatency-hwe-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-65.68.1~22.04.1
Upgrade
Upgrade ubuntu/linux-nvidia to a version that resolves this vulnerability.
Fixed in 5.15.0-1082.83
Upgrade
Upgrade ubuntu/linux-nvidia-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1032.35~22.04.1
Upgrade
Upgrade ubuntu/linux-nvidia-tegra to a version that resolves this vulnerability.
Fixed in 5.15.0-1041.41
Upgrade
Upgrade ubuntu/linux-nvidia-tegra-igx to a version that resolves this vulnerability.
Fixed in 5.15.0-1030.30
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 5.15.0-1085.91
Upgrade
Upgrade ubuntu/linux-oracle-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1030.31~22.04.1
Upgrade
Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.
Fixed in 5.15.0-1083.86
Upgrade
Upgrade ubuntu/linux-riscv-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-71.71~22.04.1
Upgrade
Upgrade ubuntu/linux-xilinx-zynqmp to a version that resolves this vulnerability.
Fixed in 5.15.0-1052.56
Upgrade
Upgrade ubuntu/linux-bluefield to a version that resolves this vulnerability.
Fixed in 5.15.0-1072.74
Upgrade
Upgrade ubuntu/linux-intel-iot-realtime to a version that resolves this vulnerability.
Fixed in 5.15.0-1081.83
Upgrade
Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.
Fixed in 5.15.0-1088.97
Upgrade
Upgrade ubuntu/linux-realtime-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.1-1026.27~22.04.1
Upgrade
Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.
Fixed in 5.15.0-1088.95+fips1
Upgrade
Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.
Fixed in 5.15.0-1094.103+fips1
Upgrade
Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.
Fixed in 5.15.0-144.157+fips1
Upgrade
Upgrade ubuntu/linux-gcp-fips to a version that resolves this vulnerability.
Fixed in 5.15.0-1087.96+fips1
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 6.8.0-71.71
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 6.8.0-1033.35
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 6.8.0-1034.39
Upgrade
Upgrade ubuntu/linux-azure-nvidia to a version that resolves this vulnerability.
Fixed in 6.8.0-1022.23
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 6.8.0-1034.36
Upgrade
Upgrade ubuntu/linux-gcp-6.14 to a version that resolves this vulnerability.
Fixed in 6.14.0-1011.11~24.04.1
Upgrade
Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.
Fixed in 6.8.0-1029.33
Upgrade
Upgrade ubuntu/linux-gkeop to a version that resolves this vulnerability.
Fixed in 6.8.0-1016.18
Upgrade
Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.
Fixed in 6.8.0-1030.30
Upgrade
Upgrade ubuntu/linux-lowlatency to a version that resolves this vulnerability.
Fixed in 6.8.0-65.68.1
Upgrade
Upgrade ubuntu/linux-nvidia to a version that resolves this vulnerability.
Fixed in 6.8.0-1032.35
Upgrade
Upgrade ubuntu/linux-nvidia-lowlatency to a version that resolves this vulnerability.
Fixed in 6.8.0-1032.35.1
Upgrade
Upgrade ubuntu/linux-nvidia-tegra to a version that resolves this vulnerability.
Fixed in 6.8.0-1009.9
Upgrade
Upgrade ubuntu/linux-oem-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1032.32
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 6.8.0-1030.31
Upgrade
Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.
Fixed in 6.8.0-1032.36
Upgrade
Upgrade ubuntu/linux-xilinx to a version that resolves this vulnerability.
Fixed in 6.8.0-1017.18
Upgrade
Upgrade ubuntu/linux-raspi-realtime to a version that resolves this vulnerability.
Fixed in 6.8.0-2028.29
Upgrade
Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.
Fixed in 6.8.1-1026.27
Upgrade
Upgrade ubuntu/linux-realtime-6.14 to a version that resolves this vulnerability.
Fixed in 6.14.0-1010.10~24.04.1
Upgrade
Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.
Fixed in 6.8.0-78.78+fips1

Event History

May 2, 2025

CVE Published

via OSV·03:15 PM

Data Sourced

via OSV·03:15 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which systems are exposed to this issue?

Systems using an affected Ubuntu kernel package are exposed only where the HFSC traffic-control qdisc is in use and a vulnerable class configuration involves child qdiscs such as netem or codel. The listed package families include ubuntu/linux, ubuntu/linux-azure, ubuntu/linux-aws-fips, ubuntu/linux-azure-fips, ubuntu/linux-gcp-fips, ubuntu/linux-gcp, ubuntu/linux-oracle, and ubuntu/linux-fips.

What access does an attacker need to exploit the vulnerability?

The provided CVSS vector indicates local access and low privileges are required, with no user interaction. Exploitation depends on being able to manipulate the relevant HFSC class and child-qdisc handling.

Are default network configurations affected?

The issue is tied to HFSC qdisc class handling and specific child qdiscs that can empty a queue during qdisc_peek_len(), including codel and netem. The provided data does not establish that this configuration is enabled or reachable by default.

What is the impact if exploitation succeeds?

The flaw can cause a use-after-free when an HFSC class is later destroyed after scheduler state is corrupted. The supplied severity vector rates confidentiality, integrity, and availability impact as high.

What does the fix change?

The fix rechecks the queue length after qdisc_peek_len() returns. This prevents a class whose queue was emptied by that operation from being added to the HFSC virtual-time tree.

UBUNTU-CVE-2025-37797: Use After Free

Affected Software

Remediation

Event History

Frequently Asked Questions

Which systems are exposed to this issue?

What access does an attacker need to exploit the vulnerability?

Are default network configurations affected?

What is the impact if exploitation succeeds?

What does the fix change?

Company

Resources

Contact

Frequently Asked Questions

Which systems are exposed to this issue?

What access does an attacker need to exploit the vulnerability?

Are default network configurations affected?

What is the impact if exploitation succeeds?

What does the fix change?