CVE-2025-37913 (GCVE-0-2025-37913)

Vulnerability from cvelistv5 – Published: 2025-05-20 15:21 – Updated: 2026-10-15 21:52
VLAI
Title
net_sched: qfq: Fix double list add in class with netem as child qdisc
Summary
In the Linux kernel, the following vulnerability has been resolved: net_sched: qfq: Fix double list add in class with netem as child qdisc As described in Gerrard's report [1], there are use cases where a netem child qdisc will make the parent qdisc's enqueue callback reentrant. In the case of qfq, there won't be a UAF, but the code will add the same classifier to the list twice, which will cause memory corruption. This patch checks whether the class was already added to the agg->active list (cl_is_active) before doing the addition to cater for the reentrant case. [1] https://lore.kernel.org/netdev/CAHcdcOm+03OD2j6R0=YHKqmy=VgJ8xEOKuP6c7mSgnp-TEJJbw@mail.gmail.com/
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-15 21:45 UTC
Assigner
Linux CNA under the mitre root
CNA scorecard D 53/100 over 7033 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea , < 041f410aec2c1751ee22b8b73ba05d38c3a6a602 (git)
Affected: 37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea , < 005a479540478a820c52de098e5e767e63e36f0a (git)
Affected: 37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea , < 0bf32d6fb1fcbf841bb9945570e0e2a70072c00f (git)
Affected: 37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea , < 0aa23e0856b7cedb3c88d8e3d281c212c7e4fbeb (git)
Affected: 37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea , < a43783119e01849fbf2fe8855634e8989b240cb4 (git)
Affected: 37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea , < 53bc0b55178bd59bdd4bcd16349505cabf54b1a2 (git)
Affected: 37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea , < 370218e8ce711684acc4cdd3cc3c6dd7956bc165 (git)
Affected: 37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea , < f139f37dcdf34b67f5bf92bc8e0f7f6b3ac63aa4 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.0
Unaffected: 0 , < 5.0 (semver)
Unaffected: 5.4.294 , ≤ 5.4.* (semver)
Unaffected: 5.10.238 , ≤ 5.10.* (semver)
Unaffected: 5.15.182 , ≤ 5.15.* (semver)
Unaffected: 6.1.138 , ≤ 6.1.* (semver)
Unaffected: 6.6.90 , ≤ 6.6.* (semver)
Unaffected: 6.12.28 , ≤ 6.12.* (semver)
Unaffected: 6.14.6 , ≤ 6.14.* (semver)
Unaffected: 6.15 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T19:57:15.106Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/08/msg00010.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-37913",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T21:45:52.578125Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T21:52:02.947Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/sched/sch_qfq.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "041f410aec2c1751ee22b8b73ba05d38c3a6a602",
              "status": "affected",
              "version": "37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea",
              "versionType": "git"
            },
            {
              "lessThan": "005a479540478a820c52de098e5e767e63e36f0a",
              "status": "affected",
              "version": "37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea",
              "versionType": "git"
            },
            {
              "lessThan": "0bf32d6fb1fcbf841bb9945570e0e2a70072c00f",
              "status": "affected",
              "version": "37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea",
              "versionType": "git"
            },
            {
              "lessThan": "0aa23e0856b7cedb3c88d8e3d281c212c7e4fbeb",
              "status": "affected",
              "version": "37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea",
              "versionType": "git"
            },
            {
              "lessThan": "a43783119e01849fbf2fe8855634e8989b240cb4",
              "status": "affected",
              "version": "37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea",
              "versionType": "git"
            },
            {
              "lessThan": "53bc0b55178bd59bdd4bcd16349505cabf54b1a2",
              "status": "affected",
              "version": "37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea",
              "versionType": "git"
            },
            {
              "lessThan": "370218e8ce711684acc4cdd3cc3c6dd7956bc165",
              "status": "affected",
              "version": "37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea",
              "versionType": "git"
            },
            {
              "lessThan": "f139f37dcdf34b67f5bf92bc8e0f7f6b3ac63aa4",
              "status": "affected",
              "version": "37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/sched/sch_qfq.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.0"
            },
            {
              "lessThan": "5.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.294",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.238",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.182",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.138",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.90",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.28",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.14.*",
              "status": "unaffected",
              "version": "6.14.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.15",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.294",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.238",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.182",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.138",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.90",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.28",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14.6",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet_sched: qfq: Fix double list add in class with netem as child qdisc\n\nAs described in Gerrard\u0027s report [1], there are use cases where a netem\nchild qdisc will make the parent qdisc\u0027s enqueue callback reentrant.\nIn the case of qfq, there won\u0027t be a UAF, but the code will add the same\nclassifier to the list twice, which will cause memory corruption.\n\nThis patch checks whether the class was already added to the agg-\u003eactive\nlist (cl_is_active) before doing the addition to cater for the reentrant\ncase.\n\n[1] https://lore.kernel.org/netdev/CAHcdcOm+03OD2j6R0=YHKqmy=VgJ8xEOKuP6c7mSgnp-TEJJbw@mail.gmail.com/"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires configuring a qfq qdisc, class, and netem child via tc/rtnetlink and then transmitting packets locally through that qdisc. Per kernel scoring guidance, tc/netlink qdisc bugs are Local.\nAC:L - The attacker fully controls every precondition \u2014 netem `duplicate 100%` makes the reentrancy deterministic, and `SO_PRIORITY` steers both the original and the cloned skb to the same qfq class, so the double list_add occurs on the first packet with no race to win.\nPR:L - The tc path is gated by `netlink_net_capable(skb, CAP_NET_ADMIN)`, which is satisfied by CAP_NET_ADMIN in the netns\u0027s owning user namespace; an unprivileged user obtains this with `unshare -Urn` (also auto-loading sch_qfq/sch_netem). This is Low, not High.\nUI:N - The attacker sets up the qdisc hierarchy and sends the packets entirely on their own; no victim action or interaction of any kind is needed.\nS:U - The corruption is confined to kernel heap structures owned by the network scheduler within the same security authority; there is no VM, IOMMU, or sandbox boundary crossed.\nC:H - The corrupted `agg-\u003eactive` list retains a dangling pointer to the kfree()\u0027d `struct qfq_class`, and `qfq_peek_skb()` reads that freed object and dereferences `cl-\u003eqdisc-\u003eops-\u003epeek`, giving an attacker who grooms the freed slab a kernel-memory read/disclosure primitive.\nI:H - The same use-after-free yields write primitives (`cl-\u003edeficit -= len` and `list_move_tail(\u0026cl-\u003ealist, ...)` writing two pointers into reclaimed memory) plus an indirect call through a freed function-pointer table, which is exploitable for control-flow hijack and privilege escalation.\nA:H - The double list add corrupts a doubly linked list, tripping BUG/WARN under CONFIG_DEBUG_LIST and otherwise leading to use-after-free dereferences in qfq_dequeue that oops the kernel; the trigger is repeatable at will."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:58:16.487Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/041f410aec2c1751ee22b8b73ba05d38c3a6a602"
        },
        {
          "url": "https://git.kernel.org/stable/c/005a479540478a820c52de098e5e767e63e36f0a"
        },
        {
          "url": "https://git.kernel.org/stable/c/0bf32d6fb1fcbf841bb9945570e0e2a70072c00f"
        },
        {
          "url": "https://git.kernel.org/stable/c/0aa23e0856b7cedb3c88d8e3d281c212c7e4fbeb"
        },
        {
          "url": "https://git.kernel.org/stable/c/a43783119e01849fbf2fe8855634e8989b240cb4"
        },
        {
          "url": "https://git.kernel.org/stable/c/53bc0b55178bd59bdd4bcd16349505cabf54b1a2"
        },
        {
          "url": "https://git.kernel.org/stable/c/370218e8ce711684acc4cdd3cc3c6dd7956bc165"
        },
        {
          "url": "https://git.kernel.org/stable/c/f139f37dcdf34b67f5bf92bc8e0f7f6b3ac63aa4"
        }
      ],
      "title": "net_sched: qfq: Fix double list add in class with netem as child qdisc",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-37913",
    "datePublished": "2025-05-20T15:21:44.793Z",
    "dateReserved": "2025-04-16T04:51:23.967Z",
    "dateUpdated": "2026-10-15T21:52:02.947Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-37913",
      "date": "2026-10-28",
      "epss": "0.00237",
      "percentile": "0.14684"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-21T03:44:19.000Z",
      "cve": "CVE-2025-37913",
      "id": "msrc_CVE-2025-37913",
      "initial_release_date": "2025-05-02T00:00:00.000Z",
      "product_status:fixed": "2",
      "product_status:known_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "net_sched: qfq: Fix double list add in class with netem as child qdisc",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-37913.json",
      "version": "2"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/sched/sch_qfq.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "041f410aec2c1751ee22b8b73ba05d38c3a6a602",
                    "status": "affected",
                    "version": "37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "005a479540478a820c52de098e5e767e63e36f0a",
                    "status": "affected",
                    "version": "37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "0bf32d6fb1fcbf841bb9945570e0e2a70072c00f",
                    "status": "affected",
                    "version": "37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "0aa23e0856b7cedb3c88d8e3d281c212c7e4fbeb",
                    "status": "affected",
                    "version": "37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "a43783119e01849fbf2fe8855634e8989b240cb4",
                    "status": "affected",
                    "version": "37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "53bc0b55178bd59bdd4bcd16349505cabf54b1a2",
                    "status": "affected",
                    "version": "37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "370218e8ce711684acc4cdd3cc3c6dd7956bc165",
                    "status": "affected",
                    "version": "37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f139f37dcdf34b67f5bf92bc8e0f7f6b3ac63aa4",
                    "status": "affected",
                    "version": "37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/sched/sch_qfq.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.0"
                  },
                  {
                    "lessThan": "5.0",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.4.*",
                    "status": "unaffected",
                    "version": "5.4.294",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.238",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.182",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.138",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.90",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.28",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.14.*",
                    "status": "unaffected",
                    "version": "6.14.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.15",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "DEC27C91-8035-49D5-8C57-B8F8541B23F7",
                    "versionEndExcluding": "5.4.294",
                    "versionStartIncluding": "5.0.1",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "0DAAEF7F-D560-47FC-8B65-20404DB82432",
                    "versionEndExcluding": "5.10.238",
                    "versionStartIncluding": "5.5",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "57E76AE8-79D9-4EC8-9845-9A86B1ED152E",
                    "versionEndExcluding": "5.15.182",
                    "versionStartIncluding": "5.11",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "B6266F82-46B4-4D38-AC4A-54C92A1DFAB2",
                    "versionEndExcluding": "6.1.138",
                    "versionStartIncluding": "5.16",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "2BE1DB09-2D62-4C63-AF19-947300669741",
                    "versionEndExcluding": "6.6.90",
                    "versionStartIncluding": "6.2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "5082CE19-0F3D-4521-AB3E-810D8255F500",
                    "versionEndExcluding": "6.12.28",
                    "versionStartIncluding": "6.7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "19E5095E-5950-43EA-8E78-FC860855293F",
                    "versionEndExcluding": "6.14.6",
                    "versionStartIncluding": "6.13",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:5.0:-:*:*:*:*:*:*",
                    "matchCriteriaId": "1D0FE595-0CFE-4491-808B-CEF691CE7B0A",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:5.0:rc3:*:*:*:*:*:*",
                    "matchCriteriaId": "963CFC36-FBAD-465F-9891-CDBBF962DFDD",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:5.0:rc4:*:*:*:*:*:*",
                    "matchCriteriaId": "1B084A7A-6047-4804-9395-6000E4A43828",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:5.0:rc5:*:*:*:*:*:*",
                    "matchCriteriaId": "C3430640-AC87-44BF-ABF5-09E0A97E3758",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:5.0:rc6:*:*:*:*:*:*",
                    "matchCriteriaId": "FDF49B77-4688-4908-9239-89B729456D22",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:5.0:rc7:*:*:*:*:*:*",
                    "matchCriteriaId": "77F342FB-3D7B-4EAE-BF8B-57B7B860BAFD",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:5.0:rc8:*:*:*:*:*:*",
                    "matchCriteriaId": "47D61679-6515-4E18-83C7-A71982CCD83C",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "8D465631-2980-487A-8E65-40AE2B9F8ED1",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "4C9D071F-B28E-46EC-AC61-22B913390211",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc3:*:*:*:*:*:*",
                    "matchCriteriaId": "13FC0DDE-E513-465E-9E81-515702D49B74",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc4:*:*:*:*:*:*",
                    "matchCriteriaId": "8C7B5B0E-4EEB-48F5-B4CF-0935A7633845",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*",
                    "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet_sched: qfq: Fix double list add in class with netem as child qdisc\n\nAs described in Gerrard\u0027s report [1], there are use cases where a netem\nchild qdisc will make the parent qdisc\u0027s enqueue callback reentrant.\nIn the case of qfq, there won\u0027t be a UAF, but the code will add the same\nclassifier to the list twice, which will cause memory corruption.\n\nThis patch checks whether the class was already added to the agg-\u003eactive\nlist (cl_is_active) before doing the addition to cater for the reentrant\ncase.\n\n[1] https://lore.kernel.org/netdev/CAHcdcOm+03OD2j6R0=YHKqmy=VgJ8xEOKuP6c7mSgnp-TEJJbw@mail.gmail.com/"
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net_sched: qfq: Se corrige la adici\u00f3n doble de lista en una clase con netem como qdisc secundaria. Como se describe en el informe de Gerrard [1], existen casos de uso en los que una qdisc secundaria netem har\u00e1 que la devoluci\u00f3n de llamada de encolado de la qdisc primaria sea reentrante. En el caso de qfq, no habr\u00e1 un UAF, pero el c\u00f3digo agregar\u00e1 el mismo clasificador a la lista dos veces, lo que causar\u00e1 corrupci\u00f3n de memoria. Este parche verifica si la clase ya se agreg\u00f3 a la lista agg-\u0026gt;active (cl_is_active) antes de realizar la adici\u00f3n para atender el caso reentrante. [1] https://lore.kernel.org/netdev/CAHcdcOm+03OD2j6R0=YHKqmy=VgJ8xEOKuP6c7mSgnp-TEJJbw@mail.gmail.com/"
          }
        ],
        "id": "CVE-2025-37913",
        "lastModified": "2026-10-15T22:18:20.607",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2025-37913",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T21:45:52.578125Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2025-05-20T16:15:27.837",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/005a479540478a820c52de098e5e767e63e36f0a"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/041f410aec2c1751ee22b8b73ba05d38c3a6a602"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/0aa23e0856b7cedb3c88d8e3d281c212c7e4fbeb"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/0bf32d6fb1fcbf841bb9945570e0e2a70072c00f"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/370218e8ce711684acc4cdd3cc3c6dd7956bc165"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/53bc0b55178bd59bdd4bcd16349505cabf54b1a2"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/a43783119e01849fbf2fe8855634e8989b240cb4"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/f139f37dcdf34b67f5bf92bc8e0f7f6b3ac63aa4"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Mailing List"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2025/08/msg00010.html"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Mailing List"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-415"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-10-16T22:55:33+00:00",
      "cve": "CVE-2025-37913",
      "id": "CVE-2025-37913",
      "initial_release_date": "2025-05-20T00:00:00+00:00",
      "product_status:known_affected": "90",
      "product_status:known_not_affected": "185",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net_sched: qfq: Fix double list add in class with netem as child qdisc",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-37913.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2025-11-03T19:57:15.106Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
              },
              {
                "url": "https://lists.debian.org/debian-lts-announce/2025/08/msg00010.html"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2025-37913",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-10-15T21:45:52.578125Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-10-15T21:45:53.387Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "net/sched/sch_qfq.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "041f410aec2c1751ee22b8b73ba05d38c3a6a602",
                  "status": "affected",
                  "version": "37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea",
                  "versionType": "git"
                },
                {
                  "lessThan": "005a479540478a820c52de098e5e767e63e36f0a",
                  "status": "affected",
                  "version": "37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea",
                  "versionType": "git"
                },
                {
                  "lessThan": "0bf32d6fb1fcbf841bb9945570e0e2a70072c00f",
                  "status": "affected",
                  "version": "37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea",
                  "versionType": "git"
                },
                {
                  "lessThan": "0aa23e0856b7cedb3c88d8e3d281c212c7e4fbeb",
                  "status": "affected",
                  "version": "37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea",
                  "versionType": "git"
                },
                {
                  "lessThan": "a43783119e01849fbf2fe8855634e8989b240cb4",
                  "status": "affected",
                  "version": "37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea",
                  "versionType": "git"
                },
                {
                  "lessThan": "53bc0b55178bd59bdd4bcd16349505cabf54b1a2",
                  "status": "affected",
                  "version": "37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea",
                  "versionType": "git"
                },
                {
                  "lessThan": "370218e8ce711684acc4cdd3cc3c6dd7956bc165",
                  "status": "affected",
                  "version": "37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea",
                  "versionType": "git"
                },
                {
                  "lessThan": "f139f37dcdf34b67f5bf92bc8e0f7f6b3ac63aa4",
                  "status": "affected",
                  "version": "37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea",
                  "versionType": "git"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "net/sched/sch_qfq.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "5.0"
                },
                {
                  "lessThan": "5.0",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.4.*",
                  "status": "unaffected",
                  "version": "5.4.294",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.10.*",
                  "status": "unaffected",
                  "version": "5.10.238",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.15.*",
                  "status": "unaffected",
                  "version": "5.15.182",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.1.*",
                  "status": "unaffected",
                  "version": "6.1.138",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.6.*",
                  "status": "unaffected",
                  "version": "6.6.90",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.12.*",
                  "status": "unaffected",
                  "version": "6.12.28",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.14.*",
                  "status": "unaffected",
                  "version": "6.14.6",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "6.15",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.4.294",
                      "versionStartIncluding": "5.0",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.10.238",
                      "versionStartIncluding": "5.0",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.15.182",
                      "versionStartIncluding": "5.0",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.1.138",
                      "versionStartIncluding": "5.0",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.6.90",
                      "versionStartIncluding": "5.0",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.12.28",
                      "versionStartIncluding": "5.0",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.14.6",
                      "versionStartIncluding": "5.0",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.15",
                      "versionStartIncluding": "5.0",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet_sched: qfq: Fix double list add in class with netem as child qdisc\n\nAs described in Gerrard\u0027s report [1], there are use cases where a netem\nchild qdisc will make the parent qdisc\u0027s enqueue callback reentrant.\nIn the case of qfq, there won\u0027t be a UAF, but the code will add the same\nclassifier to the list twice, which will cause memory corruption.\n\nThis patch checks whether the class was already added to the agg-\u003eactive\nlist (cl_is_active) before doing the addition to cater for the reentrant\ncase.\n\n[1] https://lore.kernel.org/netdev/CAHcdcOm+03OD2j6R0=YHKqmy=VgJ8xEOKuP6c7mSgnp-TEJJbw@mail.gmail.com/"
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "scenarios": [
                {
                  "lang": "en",
                  "value": "AV:L - Exploitation requires configuring a qfq qdisc, class, and netem child via tc/rtnetlink and then transmitting packets locally through that qdisc. Per kernel scoring guidance, tc/netlink qdisc bugs are Local.\nAC:L - The attacker fully controls every precondition \u2014 netem `duplicate 100%` makes the reentrancy deterministic, and `SO_PRIORITY` steers both the original and the cloned skb to the same qfq class, so the double list_add occurs on the first packet with no race to win.\nPR:L - The tc path is gated by `netlink_net_capable(skb, CAP_NET_ADMIN)`, which is satisfied by CAP_NET_ADMIN in the netns\u0027s owning user namespace; an unprivileged user obtains this with `unshare -Urn` (also auto-loading sch_qfq/sch_netem). This is Low, not High.\nUI:N - The attacker sets up the qdisc hierarchy and sends the packets entirely on their own; no victim action or interaction of any kind is needed.\nS:U - The corruption is confined to kernel heap structures owned by the network scheduler within the same security authority; there is no VM, IOMMU, or sandbox boundary crossed.\nC:H - The corrupted `agg-\u003eactive` list retains a dangling pointer to the kfree()\u0027d `struct qfq_class`, and `qfq_peek_skb()` reads that freed object and dereferences `cl-\u003eqdisc-\u003eops-\u003epeek`, giving an attacker who grooms the freed slab a kernel-memory read/disclosure primitive.\nI:H - The same use-after-free yields write primitives (`cl-\u003edeficit -= len` and `list_move_tail(\u0026cl-\u003ealist, ...)` writing two pointers into reclaimed memory) plus an indirect call through a freed function-pointer table, which is exploitable for control-flow hijack and privilege escalation.\nA:H - The double list add corrupts a doubly linked list, tripping BUG/WARN under CONFIG_DEBUG_LIST and otherwise leading to use-after-free dereferences in qfq_dequeue that oops the kernel; the trigger is repeatable at will."
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-05T11:58:16.487Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/041f410aec2c1751ee22b8b73ba05d38c3a6a602"
            },
            {
              "url": "https://git.kernel.org/stable/c/005a479540478a820c52de098e5e767e63e36f0a"
            },
            {
              "url": "https://git.kernel.org/stable/c/0bf32d6fb1fcbf841bb9945570e0e2a70072c00f"
            },
            {
              "url": "https://git.kernel.org/stable/c/0aa23e0856b7cedb3c88d8e3d281c212c7e4fbeb"
            },
            {
              "url": "https://git.kernel.org/stable/c/a43783119e01849fbf2fe8855634e8989b240cb4"
            },
            {
              "url": "https://git.kernel.org/stable/c/53bc0b55178bd59bdd4bcd16349505cabf54b1a2"
            },
            {
              "url": "https://git.kernel.org/stable/c/370218e8ce711684acc4cdd3cc3c6dd7956bc165"
            },
            {
              "url": "https://git.kernel.org/stable/c/f139f37dcdf34b67f5bf92bc8e0f7f6b3ac63aa4"
            }
          ],
          "title": "net_sched: qfq: Fix double list add in class with netem as child qdisc",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2025-37913",
        "datePublished": "2025-05-20T15:21:44.793Z",
        "dateReserved": "2025-04-16T04:51:23.967Z",
        "dateUpdated": "2026-10-15T21:52:02.947Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.