HEXACON Researchers Demonstrate Linux Kernel Exploitation Through Red-Black Tree Manipulation

Summary

William Liu and Savino Dicanosa explain how a Linux traffic scheduler bug becomes a root exploit through red-black tree manipulation, including a variant that bypasses experimental kernelCTF mitigations.

Key points

The researchers identify CVE-2025-38001 as a double-insertion bug involving HFSC and packet duplication in a child queuing discipline.
A token bucket filter blocks packet dequeueing, allowing the initial infinite-loop condition to be converted into a use-after-free.
The baseline exploit manipulates red-black tree transformations to duplicate a page pointer, create a page use-after-free and ultimately modify process credentials to obtain root.
The researchers report portability across multiple distributions and architectures and demonstrate root access on kernelCTF LTS and container-optimized targets.
A separate variant uses HFSC/HTB type confusion and tree transformations to bypass experimental allocation and cross-cache defenses.
The mitigation-target exploit uses a prefetch side channel and delayed execution trigger; its live demonstration retrieves the flag but subsequently crashes the kernel.

Article Details

Topics: [01:53] Linux network scheduler architecture and interactions between queuing disciplines
[05:51] Vulnerability discovery and HFSC double-insertion root cause
[10:10] Converting an infinite loop into a use-after-free with a token bucket filter
[11:21] Red-black tree transformations, page pointer duplication and root privilege escalation
[28:28] Live exploitation of kernelCTF baseline targets
[31:14] Experimental allocator mitigations and HFSC/HTB type confusion
[36:05] Partial node control, delayed execution and prefetch-assisted mitigation bypass