CVE-2025-37913

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-37913
In the Linux kernel, the following vulnerability has been resolved: net_sched: qfq: Fix double list add in class with netem as child qdisc As described in Gerrard's report [1], there are use cases where a netem child qdisc will make the parent qdisc's enqueue callback reentrant. In the case of qfq, there won't be a UAF, but the code will add the same classifier to the list twice, which will cause memory corruption. This patch checks whether the class was already added to the agg->active list (cl_is_active) before doing the addition to cater for the reentrant case. [1] https://lore.kernel.org/netdev/CAHcdcOm+03OD2j6R0=YHKqmy=VgJ8xEOKuP6c7mSgnp-TEJJbw@mail.gmail.com/

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/005a479540478a820c52de098e5e767e63e36f0a Patch
https://git.kernel.org/stable/c/041f410aec2c1751ee22b8b73ba05d38c3a6a602 Patch
https://git.kernel.org/stable/c/0aa23e0856b7cedb3c88d8e3d281c212c7e4fbeb Patch
https://git.kernel.org/stable/c/0bf32d6fb1fcbf841bb9945570e0e2a70072c00f Patch
https://git.kernel.org/stable/c/370218e8ce711684acc4cdd3cc3c6dd7956bc165 Patch
https://git.kernel.org/stable/c/53bc0b55178bd59bdd4bcd16349505cabf54b1a2 Patch
https://git.kernel.org/stable/c/a43783119e01849fbf2fe8855634e8989b240cb4 Patch
https://git.kernel.org/stable/c/f139f37dcdf34b67f5bf92bc8e0f7f6b3ac63aa4 Patch
https://lists.debian.org/debian-lts-announce/2025/08/msg00010.html Mailing List
https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html Mailing List
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.0:-:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.0:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.0:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.0:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.0:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.0:rc7:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.0:rc8:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc4:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
History

17 Nov 2025, 17:11

Type Values Removed Values Added
CPE cpe:2.3:o:linux:linux_kernel:5.0:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.0:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.0:-:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.0:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc4:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.0:rc7:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.0:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.0:rc8:*:*:*:*:*:*
References () https://git.kernel.org/stable/c/005a479540478a820c52de098e5e767e63e36f0a - () https://git.kernel.org/stable/c/005a479540478a820c52de098e5e767e63e36f0a - Patch
References () https://git.kernel.org/stable/c/041f410aec2c1751ee22b8b73ba05d38c3a6a602 - () https://git.kernel.org/stable/c/041f410aec2c1751ee22b8b73ba05d38c3a6a602 - Patch
References () https://git.kernel.org/stable/c/0aa23e0856b7cedb3c88d8e3d281c212c7e4fbeb - () https://git.kernel.org/stable/c/0aa23e0856b7cedb3c88d8e3d281c212c7e4fbeb - Patch
References () https://git.kernel.org/stable/c/0bf32d6fb1fcbf841bb9945570e0e2a70072c00f - () https://git.kernel.org/stable/c/0bf32d6fb1fcbf841bb9945570e0e2a70072c00f - Patch
References () https://git.kernel.org/stable/c/370218e8ce711684acc4cdd3cc3c6dd7956bc165 - () https://git.kernel.org/stable/c/370218e8ce711684acc4cdd3cc3c6dd7956bc165 - Patch
References () https://git.kernel.org/stable/c/53bc0b55178bd59bdd4bcd16349505cabf54b1a2 - () https://git.kernel.org/stable/c/53bc0b55178bd59bdd4bcd16349505cabf54b1a2 - Patch
References () https://git.kernel.org/stable/c/a43783119e01849fbf2fe8855634e8989b240cb4 - () https://git.kernel.org/stable/c/a43783119e01849fbf2fe8855634e8989b240cb4 - Patch
References () https://git.kernel.org/stable/c/f139f37dcdf34b67f5bf92bc8e0f7f6b3ac63aa4 - () https://git.kernel.org/stable/c/f139f37dcdf34b67f5bf92bc8e0f7f6b3ac63aa4 - Patch
References () https://lists.debian.org/debian-lts-announce/2025/08/msg00010.html - () https://lists.debian.org/debian-lts-announce/2025/08/msg00010.html - Mailing List
References () https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html - () https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html - Mailing List
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.8
First Time Linux
Debian
Debian debian Linux
Linux linux Kernel
CWE CWE-415

03 Nov 2025, 20:18

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2025/08/msg00010.html -

03 Nov 2025, 18:15

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html -

04 Jun 2025, 13:15

Type Values Removed Values Added
References
  • () https://git.kernel.org/stable/c/005a479540478a820c52de098e5e767e63e36f0a -
  • () https://git.kernel.org/stable/c/041f410aec2c1751ee22b8b73ba05d38c3a6a602 -
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net_sched: qfq: Se corrige la adición doble de lista en una clase con netem como qdisc secundaria. Como se describe en el informe de Gerrard [1], existen casos de uso en los que una qdisc secundaria netem hará que la devolución de llamada de encolado de la qdisc primaria sea reentrante. En el caso de qfq, no habrá un UAF, pero el código agregará el mismo clasificador a la lista dos veces, lo que causará corrupción de memoria. Este parche verifica si la clase ya se agregó a la lista agg->active (cl_is_active) antes de realizar la adición para atender el caso reentrante. [1] https://lore.kernel.org/netdev/CAHcdcOm+03OD2j6R0=YHKqmy=VgJ8xEOKuP6c7mSgnp-TEJJbw@mail.gmail.com/

20 May 2025, 16:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-05-20 16:15

Updated : 2025-11-17 17:11

NVD link : CVE-2025-37913

Mitre link : CVE-2025-37913

CVE.ORG link : CVE-2025-37913

JSON object : View

Products Affected

debian

  • debian_linux

linux

  • linux_kernel
CWE
CWE-415

Double Free