7.8

CVE-2025-37915: net_sched: drr: Fix double list add in class with netem as child qdisc

Modified
AliasesUBUNTU-CVE-2025-37915DEBIAN-CVE-2025-37915
Published 20-05-2025Last modified 15-10-2026

Vulnerability summary

CVE-2025-37915 is a high (CVSS 7.8) Double Free vulnerability in linux. EPSS estimates a 0.22% chance of exploitation in the next 30 days, higher than 13.3% of scored vulnerabilities.

Priority
Routine

Not severe (CVSS 7.8, local access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?
CVSS score
7.8/10
010
High · v3.1 (CVE.org)
EPSS score
0.22%
0%100%
Low · +0.01 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 48 · Related 43
DLA-4271-1DLA-4327-1DSA-5925-1MGASA-2025-0182MGASA-2025-0183SUSE-SU-2025:01964-1

Timeline

  1. 20-05-2025
    PublishedVulnerability first disclosed.
  2. 15-10-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: net_sched: drr: Fix double list add in class with netem as child qdisc As described in Gerrard's report [1], there are use cases where a netem child qdisc will make the parent qdisc's enqueue callback reentrant. In the case of drr, there won't be a UAF, but the code will add the same classifier to the list twice, which will cause memory corruption. In addition to checking for qlen being zero, this patch checks whether the class was already added to the active_list (cl_is_active) before adding to the list to cover for the reentrant case. [1] https://lore.kernel.org/netdev/CAHcdcOm+03OD2j6R0=YHKqmy=VgJ8xEOKuP6c7mSgnp-TEJJbw@mail.gmail.com/

CVSS metrics

5 scores · 4 sources · 2 versions

EPSS trend

Probability

0.22%

Chance of exploitation in the next 30 days

Percentile

13%

Versus all other CVEs

30-day change

Increase +0.01 pp

From 0.22% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.

Ubuntu140 products
  • linuxAll versions (No fix recorded) | < 5.15.0-144.157 | < 6.8.0-100.100
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-awsAll versions (No fix recorded) | < 5.15.0-1088.95 | < 6.8.0-1046.49
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Linux2 products
  • linux≥ 37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea, < 5da3aad1a13e7edb8ff0778a444ccf49930313e9 | ≥ 37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea, < 4b07ac06b0a712923255aaf2691637693fc7100d | ≥ 37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea, < 2968632880f1792007eedd12eeedf7f6e2b7e9f3 | ≥ 37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea, < 4f0ecf50cdf76da95828578a92f130b653ac2fcf | ≥ 37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea, < db205b92dfe0501e5b92fb7cf00971d0e44ba3eb | ≥ 37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea, < 26e75716b94d6ff9be5ea07d63675c4d189f30b4 | ≥ 37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea, < ab2248110738d4429668140ad22f530a9ee730e1 | ≥ 37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea, < f99a3fbf023e20b626be4b0f042463d598050c9a | 5.0
  • linux_kernel≥ 5.0.1, < 5.4.294 | ≥ 5.5, < 5.10.238 | ≥ 5.11, < 5.15.182 | ≥ 5.16, < 6.1.138 | ≥ 6.2, < 6.6.90 | ≥ 6.7, < 6.12.28 | ≥ 6.13, < 6.14.6 | 5.0 | 5.0:rc3 | 5.0:rc4 | 5.0:rc5 | 5.0:rc6 | 5.0:rc7 | 5.0:rc8 | 6.15:rc1 | 6.15:rc2 | 6.15:rc3 | 6.15:rc4
Debian1 product
  • linux< 6.1.140-1 | < 6.12.29-1

3 vendors · 143 products

References

47 links
Show all 47 references