CVE-2025-37915: net_sched: drr: Fix double list add in class with netem as child qdisc
In the Linux kernel, the following vulnerability has been resolved:
netsched: drr: Fix double list add in class with netem as child qdisc
As described in Gerrard's report [1], there are use cases where a netem child qdisc will make the parent qdisc's enqueue callback reentrant. In the case of drr, there won't be a UAF, but the code will add the same classifier to the list twice, which will cause memory corruption.
In addition to checking for qlen being zero, this patch checks whether the class was already added to the activelist (clisactive) before adding to the list to cover for the reentrant case.
[1] https://lore.kernel.org/netdev/CAHcdcOm+03OD2j6R0=YHKqmy=VgJ8xEOKuP6c7mSgnp-TEJJbw@mail.gmail.com/
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1
Event History
Frequently Asked Questions
What is the severity of CVE-2025-37915?
CVE-2025-37915 is classified as a medium severity vulnerability affecting the Linux kernel.
How do I fix CVE-2025-37915?
To fix CVE-2025-37915, update your Linux kernel to the latest version that includes the patch for this vulnerability.
What specifically does CVE-2025-37915 affect in the Linux kernel?
CVE-2025-37915 affects the net_sched subsystem in the Linux kernel, specifically related to the double list add when netem is used as a child qdisc.
Is CVE-2025-37915 exploitable in a production environment?
Yes, CVE-2025-37915 could potentially be exploitable in a production environment if the vulnerability is present and not patched.
When was CVE-2025-37915 disclosed?
CVE-2025-37915 was disclosed as part of scheduled security updates for the Linux kernel.