LiveActive security incident?Get immediate response
CVE Record

CVE-2025-37913: net_sched: qfq: Fix double list add in class with netem as child qdisc

In the Linux kernel, the following vulnerability has been resolved: net_sched: qfq: Fix double list add in class with netem as child qdisc As described in Gerrard's report [1], there are use cases where a netem child qdisc will make the parent qdisc's enqueue callback reentrant. In the case of qfq, there won't be a UAF, but the code will add the same classifier to the list twice, which will cause memory corruption. This patch checks whether the class was already added to the agg->active list (cl_is_active) before doing the addition to cater for the reentrant case. [1] https://lore.kernel.org/netdev/CAHcdcOm+03OD2j6R0=YHKqmy=VgJ8xEOKuP6c7mSgnp-TEJJbw@mail.gmail.com/

HighCVSS 7.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A Linux traffic-control flaw can corrupt kernel memory when QFQ scheduling uses a netem child and reentrant packet handling occurs. Exploitation requires local, low-privileged access according to the CVSS vector. Successful exploitation could affect confidentiality, integrity, and availability, but the supplied sources do not document real-world exploitation.

Executive priority

Treat as a prompt kernel-patching priority on multi-user, container-hosting, or otherwise locally exposed systems using the affected traffic-control configuration. Internet-facing status alone does not establish exposure because the vulnerability is local. Systems without QFQ plus netem usage are lower priority after configuration verification.

Technical view

Reentrant execution of QFQ's enqueue callback can add the same classifier to agg->active twice when netem is a child qdisc, corrupting memory. The record explicitly says this is not a use-after-free. The kernel fix checks cl_is_active before adding the class. CVSS 3.1 is 7.8: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Likely exposure

Exposure is limited to Linux systems running an affected or unpatched kernel where QFQ is configured with netem as a child qdisc. The supplied version data contains commit identifiers and an ambiguous version list, so assess distribution kernels by vendor backport status rather than version numbers alone.

Exploitation context

CISA KEV status is false, and the supplied sources provide no evidence of active exploitation or a public exploit. The CVSS vector indicates a local, low-complexity attack requiring low privileges and no user interaction. Whether ordinary users can reach the vulnerable configuration depends on system permissions and deployment controls.

Researcher notes

The triggering condition is QFQ enqueue reentrancy caused by a netem child qdisc. The defect duplicates list insertion and causes memory corruption; the record specifically excludes a use-after-free. The fix adds an active-state check before insertion. Exact affected distribution builds require backport analysis, and the bundle supplies no exploitability demonstration.

Mitigation direction

  • Install a vendor-supported kernel containing the applicable upstream stable fix.
  • Confirm distribution backport status through vendor advisories or package changelogs.
  • Prioritize systems permitting untrusted local users to configure affected traffic-control components.
  • If patching is delayed, request vendor-approved interim guidance; none is specified in the bundle.

Validation and detection

  • Inventory running kernel builds and identify hosts using QFQ with netem child qdiscs.
  • Verify the installed kernel includes the applicable fix or a documented vendor backport.
  • Review kernel logs and monitoring for unexplained memory corruption, crashes, or traffic-control failures.
  • Regression-test required QFQ and netem behavior after updating in a controlled environment.
Prepared
Confidence
medium
Sources
12

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-37913 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
1ADP providers
11Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.8CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.8High
CVSS 3.1 vector shape for CVE-2025-37913Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea, 37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea, 37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea, 37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea, 37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea, 37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea, 37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea, 37d9cf1a3ce35de3df6f7d209bfb1f50cf188ceaunaffected
LinuxLinux5.0, 0, 5.4.294, 5.10.238, 5.15.182, 6.1.138, 6.6.90, 6.12.28, 6.14.6, 6.15affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.