LiveActive security incident?Get immediate response
CVE Record

CVE-2025-37915: net_sched: drr: Fix double list add in class with netem as child qdisc

In the Linux kernel, the following vulnerability has been resolved: net_sched: drr: Fix double list add in class with netem as child qdisc As described in Gerrard's report [1], there are use cases where a netem child qdisc will make the parent qdisc's enqueue callback reentrant. In the case of drr, there won't be a UAF, but the code will add the same classifier to the list twice, which will cause memory corruption. In addition to checking for qlen being zero, this patch checks whether the class was already added to the active_list (cl_is_active) before adding to the list to cover for the reentrant case. [1] https://lore.kernel.org/netdev/CAHcdcOm+03OD2j6R0=YHKqmy=VgJ8xEOKuP6c7mSgnp-TEJJbw@mail.gmail.com/

HighCVSS 7.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A flaw in Linux traffic scheduling can corrupt kernel memory when DRR uses netem as a child scheduler and triggers reentrant processing. Successful abuse requires local access and privileges, but the stated potential impact includes loss of confidentiality, integrity, and availability.

Executive priority

Treat this as a high-priority kernel maintenance issue, especially on multi-user or delegated networking systems. It is not presently an emergency driven by known active exploitation, but kernel memory corruption warrants prompt exposure assessment and deployment of supported updates.

Technical view

During a reentrant enqueue callback, the DRR scheduler can add the same class to active_list twice when netem is its child qdisc. The resulting list corruption can corrupt kernel memory. The fix checks cl_is_active before inserting the class.

Likely exposure

Exposure is limited to Linux systems running an affected kernel and using the relevant DRR-with-netem traffic-control arrangement. The CVSS vector specifies local access, low privileges, low complexity, and no user interaction. The supplied version data is ambiguous, so vendor package status should determine exposure.

Exploitation context

The source bundle does not establish active exploitation, and the CVE is not listed as KEV. It documents the triggering condition and memory corruption, but provides no evidence of reliable privilege escalation, code execution, or exploitation in the wild.

Researcher notes

The reported defect is a double list insertion caused by enqueue reentrancy, not a documented use-after-free. The patch adds an active-state guard alongside the queue-length check. CVSS 3.1 is 7.8 with local, low-privilege attack requirements and high potential impact across confidentiality, integrity, and availability.

Mitigation direction

  • Update to a vendor-supported kernel package incorporating the referenced stable fix.
  • Check Linux distribution advisories for the corrected package applicable to each deployed release.
  • Prioritize systems where untrusted local users can access or influence traffic-control configuration.
  • If immediate updating is impossible, seek vendor-supported guidance for safely avoiding the affected configuration.

Validation and detection

  • Inventory deployed kernel versions and map them to vendor security advisory status.
  • Identify systems using DRR with netem configured as a child qdisc.
  • Confirm the installed kernel contains the relevant stable fix or vendor backport.
  • Validate kernel updates and traffic-control behavior in staging before production rollout.
Prepared
Confidence
high
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-37915 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
1ADP providers
11Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.8CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.8High
CVSS 3.1 vector shape for CVE-2025-37915Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea, 37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea, 37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea, 37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea, 37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea, 37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea, 37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea, 37d9cf1a3ce35de3df6f7d209bfb1f50cf188ceaunaffected
LinuxLinux5.0, 0, 5.4.294, 5.10.238, 5.15.182, 6.1.138, 6.6.90, 6.12.28, 6.14.6, 6.15affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.