CVE-2025-37913

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-37913", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T04:51:23.967Z", "datePublished": "2025-05-20T15:21:44.793Z", "dateUpdated": "2026-10-15T21:52:02.947Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:58:16.487Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet_sched: qfq: Fix double list add in class with netem as child qdisc\n\nAs described in Gerrard's report [1], there are use cases where a netem\nchild qdisc will make the parent qdisc's enqueue callback reentrant.\nIn the case of qfq, there won't be a UAF, but the code will add the same\nclassifier to the list twice, which will cause memory corruption.\n\nThis patch checks whether the class was already added to the agg->active\nlist (cl_is_active) before doing the addition to cater for the reentrant\ncase.\n\n[1] https://lore.kernel.org/netdev/CAHcdcOm+03OD2j6R0=YHKqmy=VgJ8xEOKuP6c7mSgnp-TEJJbw@mail.gmail.com/"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - Exploitation requires configuring a qfq qdisc, class, and netem child via tc/rtnetlink and then transmitting packets locally through that qdisc. Per kernel scoring guidance, tc/netlink qdisc bugs are Local.\nAC:L - The attacker fully controls every precondition \u2014 netem `duplicate 100%` makes the reentrancy deterministic, and `SO_PRIORITY` steers both the original and the cloned skb to the same qfq class, so the double list_add occurs on the first packet with no race to win.\nPR:L - The tc path is gated by `netlink_net_capable(skb, CAP_NET_ADMIN)`, which is satisfied by CAP_NET_ADMIN in the netns's owning user namespace; an unprivileged user obtains this with `unshare -Urn` (also auto-loading sch_qfq/sch_netem). This is Low, not High.\nUI:N - The attacker sets up the qdisc hierarchy and sends the packets entirely on their own; no victim action or interaction of any kind is needed.\nS:U - The corruption is confined to kernel heap structures owned by the network scheduler within the same security authority; there is no VM, IOMMU, or sandbox boundary crossed.\nC:H - The corrupted `agg->active` list retains a dangling pointer to the kfree()'d `struct qfq_class`, and `qfq_peek_skb()` reads that freed object and dereferences `cl->qdisc->ops->peek`, giving an attacker who grooms the freed slab a kernel-memory read/disclosure primitive.\nI:H - The same use-after-free yields write primitives (`cl->deficit -= len` and `list_move_tail(&cl->alist, ...)` writing two pointers into reclaimed memory) plus an indirect call through a freed function-pointer table, which is exploitable for control-flow hijack and privilege escalation.\nA:H - The double list add corrupts a doubly linked list, tripping BUG/WARN under CONFIG_DEBUG_LIST and otherwise leading to use-after-free dereferences in qfq_dequeue that oops the kernel; the trigger is repeatable at will."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/sched/sch_qfq.c"], "versions": [{"version": "37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea", "lessThan": "041f410aec2c1751ee22b8b73ba05d38c3a6a602", "status": "affected", "versionType": "git"}, {"version": "37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea", "lessThan": "005a479540478a820c52de098e5e767e63e36f0a", "status": "affected", "versionType": "git"}, {"version": "37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea", "lessThan": "0bf32d6fb1fcbf841bb9945570e0e2a70072c00f", "status": "affected", "versionType": "git"}, {"version": "37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea", "lessThan": "0aa23e0856b7cedb3c88d8e3d281c212c7e4fbeb", "status": "affected", "versionType": "git"}, {"version": "37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea", "lessThan": "a43783119e01849fbf2fe8855634e8989b240cb4", "status": "affected", "versionType": "git"}, {"version": "37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea", "lessThan": "53bc0b55178bd59bdd4bcd16349505cabf54b1a2", "status": "affected", "versionType": "git"}, {"version": "37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea", "lessThan": "370218e8ce711684acc4cdd3cc3c6dd7956bc165", "status": "affected", "versionType": "git"}, {"version": "37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea", "lessThan": "f139f37dcdf34b67f5bf92bc8e0f7f6b3ac63aa4", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/sched/sch_qfq.c"], "versions": [{"version": "5.0", "status": "affected"}, {"version": "0", "lessThan": "5.0", "status": "unaffected", "versionType": "semver"}, {"version": "5.4.294", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.238", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.182", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.138", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.90", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.28", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.14.6", "lessThanOrEqual": "6.14.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.15", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.0", "versionEndExcluding": "5.4.294"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.0", "versionEndExcluding": "5.10.238"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.0", "versionEndExcluding": "5.15.182"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.0", "versionEndExcluding": "6.1.138"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.0", "versionEndExcluding": "6.6.90"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.0", "versionEndExcluding": "6.12.28"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.0", "versionEndExcluding": "6.14.6"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.0", "versionEndExcluding": "6.15"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/041f410aec2c1751ee22b8b73ba05d38c3a6a602"}, {"url": "https://git.kernel.org/stable/c/005a479540478a820c52de098e5e767e63e36f0a"}, {"url": "https://git.kernel.org/stable/c/0bf32d6fb1fcbf841bb9945570e0e2a70072c00f"}, {"url": "https://git.kernel.org/stable/c/0aa23e0856b7cedb3c88d8e3d281c212c7e4fbeb"}, {"url": "https://git.kernel.org/stable/c/a43783119e01849fbf2fe8855634e8989b240cb4"}, {"url": "https://git.kernel.org/stable/c/53bc0b55178bd59bdd4bcd16349505cabf54b1a2"}, {"url": "https://git.kernel.org/stable/c/370218e8ce711684acc4cdd3cc3c6dd7956bc165"}, {"url": "https://git.kernel.org/stable/c/f139f37dcdf34b67f5bf92bc8e0f7f6b3ac63aa4"}], "title": "net_sched: qfq: Fix double list add in class with netem as child qdisc", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"}, {"url": "https://lists.debian.org/debian-lts-announce/2025/08/msg00010.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T19:57:15.106Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-37913", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:45:52.578125Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:52:02.947Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"}, {"url": "https://lists.debian.org/debian-lts-announce/2025/08/msg00010.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T19:57:15.106Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-37913", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:45:52.578125Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:45:53.387Z"}}], "cna": {"title": "net_sched: qfq: Fix double list add in class with netem as child qdisc", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - Exploitation requires configuring a qfq qdisc, class, and netem child via tc/rtnetlink and then transmitting packets locally through that qdisc. Per kernel scoring guidance, tc/netlink qdisc bugs are Local.\nAC:L - The attacker fully controls every precondition \u2014 netem `duplicate 100%` makes the reentrancy deterministic, and `SO_PRIORITY` steers both the original and the cloned skb to the same qfq class, so the double list_add occurs on the first packet with no race to win.\nPR:L - The tc path is gated by `netlink_net_capable(skb, CAP_NET_ADMIN)`, which is satisfied by CAP_NET_ADMIN in the netns's owning user namespace; an unprivileged user obtains this with `unshare -Urn` (also auto-loading sch_qfq/sch_netem). This is Low, not High.\nUI:N - The attacker sets up the qdisc hierarchy and sends the packets entirely on their own; no victim action or interaction of any kind is needed.\nS:U - The corruption is confined to kernel heap structures owned by the network scheduler within the same security authority; there is no VM, IOMMU, or sandbox boundary crossed.\nC:H - The corrupted `agg->active` list retains a dangling pointer to the kfree()'d `struct qfq_class`, and `qfq_peek_skb()` reads that freed object and dereferences `cl->qdisc->ops->peek`, giving an attacker who grooms the freed slab a kernel-memory read/disclosure primitive.\nI:H - The same use-after-free yields write primitives (`cl->deficit -= len` and `list_move_tail(&cl->alist, ...)` writing two pointers into reclaimed memory) plus an indirect call through a freed function-pointer table, which is exploitable for control-flow hijack and privilege escalation.\nA:H - The double list add corrupts a doubly linked list, tripping BUG/WARN under CONFIG_DEBUG_LIST and otherwise leading to use-after-free dereferences in qfq_dequeue that oops the kernel; the trigger is repeatable at will."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea", "lessThan": "041f410aec2c1751ee22b8b73ba05d38c3a6a602", "versionType": "git"}, {"status": "affected", "version": "37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea", "lessThan": "005a479540478a820c52de098e5e767e63e36f0a", "versionType": "git"}, {"status": "affected", "version": "37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea", "lessThan": "0bf32d6fb1fcbf841bb9945570e0e2a70072c00f", "versionType": "git"}, {"status": "affected", "version": "37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea", "lessThan": "0aa23e0856b7cedb3c88d8e3d281c212c7e4fbeb", "versionType": "git"}, {"status": "affected", "version": "37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea", "lessThan": "a43783119e01849fbf2fe8855634e8989b240cb4", "versionType": "git"}, {"status": "affected", "version": "37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea", "lessThan": "53bc0b55178bd59bdd4bcd16349505cabf54b1a2", "versionType": "git"}, {"status": "affected", "version": "37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea", "lessThan": "370218e8ce711684acc4cdd3cc3c6dd7956bc165", "versionType": "git"}, {"status": "affected", "version": "37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea", "lessThan": "f139f37dcdf34b67f5bf92bc8e0f7f6b3ac63aa4", "versionType": "git"}], "programFiles": ["net/sched/sch_qfq.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.0"}, {"status": "unaffected", "version": "0", "lessThan": "5.0", "versionType": "semver"}, {"status": "unaffected", "version": "5.4.294", "versionType": "semver", "lessThanOrEqual": "5.4.*"}, {"status": "unaffected", "version": "5.10.238", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.182", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.138", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.90", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.28", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.14.6", "versionType": "semver", "lessThanOrEqual": "6.14.*"}, {"status": "unaffected", "version": "6.15", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/sched/sch_qfq.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/041f410aec2c1751ee22b8b73ba05d38c3a6a602"}, {"url": "https://git.kernel.org/stable/c/005a479540478a820c52de098e5e767e63e36f0a"}, {"url": "https://git.kernel.org/stable/c/0bf32d6fb1fcbf841bb9945570e0e2a70072c00f"}, {"url": "https://git.kernel.org/stable/c/0aa23e0856b7cedb3c88d8e3d281c212c7e4fbeb"}, {"url": "https://git.kernel.org/stable/c/a43783119e01849fbf2fe8855634e8989b240cb4"}, {"url": "https://git.kernel.org/stable/c/53bc0b55178bd59bdd4bcd16349505cabf54b1a2"}, {"url": "https://git.kernel.org/stable/c/370218e8ce711684acc4cdd3cc3c6dd7956bc165"}, {"url": "https://git.kernel.org/stable/c/f139f37dcdf34b67f5bf92bc8e0f7f6b3ac63aa4"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet_sched: qfq: Fix double list add in class with netem as child qdisc\n\nAs described in Gerrard's report [1], there are use cases where a netem\nchild qdisc will make the parent qdisc's enqueue callback reentrant.\nIn the case of qfq, there won't be a UAF, but the code will add the same\nclassifier to the list twice, which will cause memory corruption.\n\nThis patch checks whether the class was already added to the agg->active\nlist (cl_is_active) before doing the addition to cater for the reentrant\ncase.\n\n[1] https://lore.kernel.org/netdev/CAHcdcOm+03OD2j6R0=YHKqmy=VgJ8xEOKuP6c7mSgnp-TEJJbw@mail.gmail.com/"}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.4.294", "versionStartIncluding": "5.0"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.238", "versionStartIncluding": "5.0"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.182", "versionStartIncluding": "5.0"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.138", "versionStartIncluding": "5.0"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.90", "versionStartIncluding": "5.0"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.28", "versionStartIncluding": "5.0"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.14.6", "versionStartIncluding": "5.0"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.15", "versionStartIncluding": "5.0"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:58:16.487Z"}}}, "cveMetadata": {"cveId": "CVE-2025-37913", "state": "PUBLISHED", "dateUpdated": "2026-10-15T21:52:02.947Z", "dateReserved": "2025-04-16T04:51:23.967Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2025-05-20T15:21:44.793Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/sched/sch_qfq.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "041f410aec2c1751ee22b8b73ba05d38c3a6a602", "status": "affected", "version": "37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea", "versionType": "git"}, {"lessThan": "005a479540478a820c52de098e5e767e63e36f0a", "status": "affected", "version": "37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea", "versionType": "git"}, {"lessThan": "0bf32d6fb1fcbf841bb9945570e0e2a70072c00f", "status": "affected", "version": "37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea", "versionType": "git"}, {"lessThan": "0aa23e0856b7cedb3c88d8e3d281c212c7e4fbeb", "status": "affected", "version": "37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea", "versionType": "git"}, {"lessThan": "a43783119e01849fbf2fe8855634e8989b240cb4", "status": "affected", "version": "37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea", "versionType": "git"}, {"lessThan": "53bc0b55178bd59bdd4bcd16349505cabf54b1a2", "status": "affected", "version": "37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea", "versionType": "git"}, {"lessThan": "370218e8ce711684acc4cdd3cc3c6dd7956bc165", "status": "affected", "version": "37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea", "versionType": "git"}, {"lessThan": "f139f37dcdf34b67f5bf92bc8e0f7f6b3ac63aa4", "status": "affected", "version": "37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/sched/sch_qfq.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.0"}, {"lessThan": "5.0", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.294", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.238", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.182", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.138", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.90", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.28", "versionType": "semver"}, {"lessThanOrEqual": "6.14.*", "status": "unaffected", "version": "6.14.6", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.15", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "DEC27C91-8035-49D5-8C57-B8F8541B23F7", "versionEndExcluding": "5.4.294", "versionStartIncluding": "5.0.1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "0DAAEF7F-D560-47FC-8B65-20404DB82432", "versionEndExcluding": "5.10.238", "versionStartIncluding": "5.5", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "57E76AE8-79D9-4EC8-9845-9A86B1ED152E", "versionEndExcluding": "5.15.182", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "B6266F82-46B4-4D38-AC4A-54C92A1DFAB2", "versionEndExcluding": "6.1.138", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "2BE1DB09-2D62-4C63-AF19-947300669741", "versionEndExcluding": "6.6.90", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "5082CE19-0F3D-4521-AB3E-810D8255F500", "versionEndExcluding": "6.12.28", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "19E5095E-5950-43EA-8E78-FC860855293F", "versionEndExcluding": "6.14.6", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:5.0:-:*:*:*:*:*:*", "matchCriteriaId": "1D0FE595-0CFE-4491-808B-CEF691CE7B0A", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:5.0:rc3:*:*:*:*:*:*", "matchCriteriaId": "963CFC36-FBAD-465F-9891-CDBBF962DFDD", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:5.0:rc4:*:*:*:*:*:*", "matchCriteriaId": "1B084A7A-6047-4804-9395-6000E4A43828", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:5.0:rc5:*:*:*:*:*:*", "matchCriteriaId": "C3430640-AC87-44BF-ABF5-09E0A97E3758", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:5.0:rc6:*:*:*:*:*:*", "matchCriteriaId": "FDF49B77-4688-4908-9239-89B729456D22", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:5.0:rc7:*:*:*:*:*:*", "matchCriteriaId": "77F342FB-3D7B-4EAE-BF8B-57B7B860BAFD", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:5.0:rc8:*:*:*:*:*:*", "matchCriteriaId": "47D61679-6515-4E18-83C7-A71982CCD83C", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc1:*:*:*:*:*:*", "matchCriteriaId": "8D465631-2980-487A-8E65-40AE2B9F8ED1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc2:*:*:*:*:*:*", "matchCriteriaId": "4C9D071F-B28E-46EC-AC61-22B913390211", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc3:*:*:*:*:*:*", "matchCriteriaId": "13FC0DDE-E513-465E-9E81-515702D49B74", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc4:*:*:*:*:*:*", "matchCriteriaId": "8C7B5B0E-4EEB-48F5-B4CF-0935A7633845", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*", "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet_sched: qfq: Fix double list add in class with netem as child qdisc\n\nAs described in Gerrard's report [1], there are use cases where a netem\nchild qdisc will make the parent qdisc's enqueue callback reentrant.\nIn the case of qfq, there won't be a UAF, but the code will add the same\nclassifier to the list twice, which will cause memory corruption.\n\nThis patch checks whether the class was already added to the agg->active\nlist (cl_is_active) before doing the addition to cater for the reentrant\ncase.\n\n[1] https://lore.kernel.org/netdev/CAHcdcOm+03OD2j6R0=YHKqmy=VgJ8xEOKuP6c7mSgnp-TEJJbw@mail.gmail.com/"}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net_sched: qfq: Se corrige la adici\u00f3n doble de lista en una clase con netem como qdisc secundaria. Como se describe en el informe de Gerrard [1], existen casos de uso en los que una qdisc secundaria netem har\u00e1 que la devoluci\u00f3n de llamada de encolado de la qdisc primaria sea reentrante. En el caso de qfq, no habr\u00e1 un UAF, pero el c\u00f3digo agregar\u00e1 el mismo clasificador a la lista dos veces, lo que causar\u00e1 corrupci\u00f3n de memoria. Este parche verifica si la clase ya se agreg\u00f3 a la lista agg->active (cl_is_active) antes de realizar la adici\u00f3n para atender el caso reentrante. [1] https://lore.kernel.org/netdev/CAHcdcOm+03OD2j6R0=YHKqmy=VgJ8xEOKuP6c7mSgnp-TEJJbw@mail.gmail.com/"}], "id": "CVE-2025-37913", "lastModified": "2026-10-15T22:18:20.607", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-37913", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-15T21:45:52.578125Z", "version": "2.0.3"}}]}, "published": "2025-05-20T16:15:27.837", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/005a479540478a820c52de098e5e767e63e36f0a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/041f410aec2c1751ee22b8b73ba05d38c3a6a602"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/0aa23e0856b7cedb3c88d8e3d281c212c7e4fbeb"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/0bf32d6fb1fcbf841bb9945570e0e2a70072c00f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/370218e8ce711684acc4cdd3cc3c6dd7956bc165"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/53bc0b55178bd59bdd4bcd16349505cabf54b1a2"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/a43783119e01849fbf2fe8855634e8989b240cb4"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/f139f37dcdf34b67f5bf92bc8e0f7f6b3ac63aa4"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List"], "url": "https://lists.debian.org/debian-lts-announce/2025/08/msg00010.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List"], "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-415"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: net_sched: qfq: Fix double list add in class with netem as child qdisc", "id": "2367518", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2367518"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.3", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H", "status": "draft"}, "cwe": "CWE-367", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nnet_sched: qfq: Fix double list add in class with netem as child qdisc\nAs described in Gerrard's report [1], there are use cases where a netem\nchild qdisc will make the parent qdisc's enqueue callback reentrant.\nIn the case of qfq, there won't be a UAF, but the code will add the same\nclassifier to the list twice, which will cause memory corruption.\nThis patch checks whether the class was already added to the agg->active\nlist (cl_is_active) before doing the addition to cater for the reentrant\ncase.\n[1] https://lore.kernel.org/netdev/CAHcdcOm+03OD2j6R0=YHKqmy=VgJ8xEOKuP6c7mSgnp-TEJJbw@mail.gmail.com/"], "name": "CVE-2025-37913", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-05-20T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-37913\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-37913\nhttps://lore.kernel.org/linux-cve-announce/2025052000-CVE-2025-37913-95be@gregkh/T"], "threat_severity": "Moderate"}

{"created": "2025-06-27T09:26:51.456392+00:00", "updated": "2025-06-27T09:26:51.456471+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}