LiveActive security incident?Get immediate response
CVE Record

CVE-2025-37798: codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()

In the Linux kernel, the following vulnerability has been resolved: codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() After making all ->qlen_notify() callbacks idempotent, now it is safe to remove the check of qlen!=0 from both fq_codel_dequeue() and codel_qdisc_dequeue().

HighCVSS 7.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

CVE-2025-37798 is a Linux kernel flaw in CoDel/fq_codel queueing code. It is rated high because a local, low-privileged attacker could potentially impact confidentiality, integrity, and availability. Public sources do not show active exploitation. Treat it as an important kernel maintenance item, especially on multi-user Linux systems.

Executive priority

Schedule remediation in the next regular or accelerated kernel patch cycle. Escalate priority for systems with local user access, shared hosting, or container workloads. There is no sourced evidence of active exploitation, so this is high-priority hygiene rather than an emergency response item.

Technical view

The issue was resolved by removing a qlen check before qdisc_tree_reduce_backlog() after qlen_notify() callbacks became idempotent. The CVSS 3.1 vector is AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating local low-privilege exploitation with high impact. Upstream stable commits and Debian LTS advisories are referenced.

Likely exposure

Exposure is primarily Linux systems running affected kernel versions listed in the CVE data. The source data identifies Linux kernel versions and stable commits, but does not fully describe configuration prerequisites. Local access or an existing low-privileged account is required according to CVSS.

Exploitation context

No CISA KEV listing is indicated, and the provided sources do not report active exploitation or public exploit tooling. The attack vector is local, so risk is higher on shared hosts, developer systems, container hosts, and servers where untrusted users can run code.

Researcher notes

The affected-version data is broad and partly commit-oriented, so distribution backport status matters more than upstream version strings alone. The public description is limited to the kernel fix rationale and does not provide exploit mechanics. Validate against vendor advisories and the listed stable commits.

Mitigation direction

  • Update Linux kernels through vendor or distribution security channels.
  • Prioritize shared, multi-user, and container-hosting Linux systems.
  • Review Debian LTS advisories if using Debian LTS kernels.
  • Track the referenced upstream stable commits for backport confirmation.
  • If no vendor package is available, monitor vendor guidance before applying custom kernels.

Validation and detection

  • Inventory Linux kernel versions across servers, workstations, and appliances.
  • Compare installed kernels with vendor advisories for CVE-2025-37798.
  • Confirm patched packages or backported stable commits are installed.
  • Verify systems rebooted into the corrected kernel after updates.
  • Document exceptions where vendor guidance is still pending.
Prepared
Confidence
medium
Sources
12

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-37798 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
1ADP providers
12Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.8CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.8High
CVSS 3.1 vector shape for CVE-2025-37798Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux76e3cc126bb223013a6b9a0e2a51238d1ef2e409, 76e3cc126bb223013a6b9a0e2a51238d1ef2e409, 76e3cc126bb223013a6b9a0e2a51238d1ef2e409, 76e3cc126bb223013a6b9a0e2a51238d1ef2e409, 76e3cc126bb223013a6b9a0e2a51238d1ef2e409, 76e3cc126bb223013a6b9a0e2a51238d1ef2e409, 76e3cc126bb223013a6b9a0e2a51238d1ef2e409, 76e3cc126bb223013a6b9a0e2a51238d1ef2e409, 76e3cc126bb223013a6b9a0e2a51238d1ef2e409unaffected
LinuxLinux3.5, 0, 5.4.297, 5.10.241, 5.15.190, 6.1.135, 6.6.88, 6.12.24, 6.13.12, 6.14.3, 6.15affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.