CVE-2025-37914: net_sched: ets: Fix double list add in class with netem as child qdisc
In the Linux kernel, the following vulnerability has been resolved:
netsched: ets: Fix double list add in class with netem as child qdisc
As described in Gerrard's report [1], there are use cases where a netem child qdisc will make the parent qdisc's enqueue callback reentrant. In the case of ets, there won't be a UAF, but the code will add the same classifier to the list twice, which will cause memory corruption.
In addition to checking for qlen being zero, this patch checks whether the class was already added to the activelist (clisactive) before doing the addition to cater for the reentrant case.
[1] https://lore.kernel.org/netdev/CAHcdcOm+03OD2j6R0=YHKqmy=VgJ8xEOKuP6c7mSgnp-TEJJbw@mail.gmail.com/
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1
Event History
Frequently Asked Questions
What is the severity of CVE-2025-37914?
The CVE-2025-37914 vulnerability in the Linux kernel has been classified as high severity due to the potential for reentrant enqueue callback issues.
How do I fix CVE-2025-37914?
To address CVE-2025-37914, it is recommended to update to the latest version of the Linux kernel that includes the patch for this vulnerability.
What systems are affected by CVE-2025-37914?
CVE-2025-37914 affects all systems running vulnerable versions of the Linux kernel that use netem as a child queue discipline.
What type of vulnerability is CVE-2025-37914?
CVE-2025-37914 is a logic vulnerability affecting the net_sched subsystem of the Linux kernel.
When was CVE-2025-37914 resolved?
CVE-2025-37914 was resolved in a recent update to the Linux kernel following reports of the issue.