Riskcovery

CVE-2025-37913

net_sched: qfq: Fix double list add in class with netem as child qdisc

State
Published
Severity
7.8 High
Published
May 20, 2025
Updated
Oct 15, 2026
Reserved
Apr 16, 2025

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

net_sched: qfq: Fix double list add in class with netem as child qdisc

As described in Gerrard's report [1], there are use cases where a netem child qdisc will make the parent qdisc's enqueue callback reentrant. In the case of qfq, there won't be a UAF, but the code will add the same classifier to the list twice, which will cause memory corruption.

This patch checks whether the class was already added to the agg->active list (cl_is_active) before doing the addition to cater for the reentrant case.

[1] https://lore.kernel.org/netdev/CAHcdcOm+03OD2j6R0=YHKqmy=VgJ8xEOKuP6c7mSgnp-TEJJbw@mail.gmail.com/

Scores

CVSSScoreVectorSource
3.17.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea to before 041f410aec2c1751ee22b8b73ba05d38c3a6a602Affected
  • 37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea to before 005a479540478a820c52de098e5e767e63e36f0aAffected
  • 37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea to before 0bf32d6fb1fcbf841bb9945570e0e2a70072c00fAffected
  • 37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea to before 0aa23e0856b7cedb3c88d8e3d281c212c7e4fbebAffected
  • 37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea to before a43783119e01849fbf2fe8855634e8989b240cb4Affected
  • 37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea to before 53bc0b55178bd59bdd4bcd16349505cabf54b1a2Affected
  • 37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea to before 370218e8ce711684acc4cdd3cc3c6dd7956bc165Affected
  • 37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea to before f139f37dcdf34b67f5bf92bc8e0f7f6b3ac63aa4Affected
LinuxLinux
  • 5.0Affected
  • before 5.0Not affected
  • 5.4.294 through 5.4.*Not affected
  • 5.10.238 through 5.10.*Not affected
  • 5.15.182 through 5.15.*Not affected
  • 6.1.138 through 6.1.*Not affected
  • 6.6.90 through 6.6.*Not affected
  • 6.12.28 through 6.12.*Not affected
  • 6.14.6 through 6.14.*Not affected
  • 6.15 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.