Linux Kernel HFSC Queue Stats Inconsistency Leading to UAF Fix

From this webpage screenshot, the following key information about the vulnerability can be obtained: Vulnerability Description: - During the operation, the function exhibits inconsistency between queue length ( ) and backlog ( ) statistics. - When adding the first packet to an HFSC class, calls the child qdisc’s operation before incrementing and . If the child qdisc uses , this may trigger an immediate dequeue operation and potential packet drop. - In this scenario, is invoked, but the HFSC qdisc’s and have not yet been updated, leading to inconsistent queue statistics. This may result in an empty HFSC class appearing in the active list, potentially causing further issues such as use-after-free. Fix: - The issue is resolved by incrementing and before calling the child qdisc’s operation. - This ensures that queue length and backlog remain accurate even if packet drops or dequeues are triggered during the operation. Related Files and Code Changes: - File: - Code changes: 3 lines inserted, 3 lines deleted Commit Information: - Committed by: Cong Wang - Commit time: 2025-05-18 15:20:37 -0700 - Commit hash: Review and Sign-offs: - Reported by: Mingi Cho - Reviewed by: Simon Horman, Jamal Hadi Salim, Paolo Abeni, Sasha Levin - Signed-off by: Cong Wang, Simon Horman, Jamal Hadi Salim, Paolo Abeni, Sasha Levin

Goal Reached Thanks to every supporter — we hit 100%!

Linux Kernel HFSC Queue Stats Inconsistency Leading to UAF Fix