CVE-2025-37823

In the Linux kernel, the following vulnerability has been resolved:

net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too

Similarly to the previous patch, we need to safe guard hfsc_dequeue() too. But for this one, we don't have a reliable reproducer.

This vulnerability is assessed as having a Moderate impact because exploitation requires local access with network administrative privileges (CAP_NET_ADMIN) or access to unprivileged user namespaces. The Hierarchical Fair Service Curve (HFSC) packet scheduler is not enabled by default in standard Red Hat Enterprise Linux deployments. A local user with sufficient privileges to modify traffic control configurations could trigger this flaw to cause a kernel crash resulting in a denial of service or potentially read sensitive kernel memory.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.