{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2025-37915", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T04:51:23.967Z", "datePublished": "2025-05-20T15:21:46.440Z", "dateUpdated": "2026-08-05T11:58:18.644Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:58:18.644Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet_sched: drr: Fix double list add in class with netem as child qdisc\n\nAs described in Gerrard's report [1], there are use cases where a netem\nchild qdisc will make the parent qdisc's enqueue callback reentrant.\nIn the case of drr, there won't be a UAF, but the code will add the same\nclassifier to the list twice, which will cause memory corruption.\n\nIn addition to checking for qlen being zero, this patch checks whether the\nclass was already added to the active_list (cl_is_active) before adding\nto the list to cover for the reentrant case.\n\n[1] https://lore.kernel.org/netdev/CAHcdcOm+03OD2j6R0=YHKqmy=VgJ8xEOKuP6c7mSgnp-TEJJbw@mail.gmail.com/" } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The vulnerability is reached by configuring a DRR qdisc with a netem child via rtnetlink (tc) and then transmitting a packet through it, all of which requires local system access. Per kernel scoring convention, tc/netlink qdisc bugs are Local.\nAC:L - The attacker sets `netem duplicate 100%`, making the reentrant enqueue deterministic rather than probabilistic, and controls both the qdisc topology and the packet that triggers it. sch_drr and sch_netem are enabled as modules in mainstream distribution kernels, so no rare configuration is needed.\nPR:L - Qdisc configuration only needs CAP_NET_ADMIN in the network namespace's user namespace (`ns_capable(net->user_ns, CAP_NET_ADMIN)`), which any unprivileged user obtains with `unshare -Urn` plus a dummy/veth device. No real root in the initial namespace is required.\nUI:N - The attacker performs every step — creating the namespace, installing the drr/netem qdisc pair, and sending the packet — with no action from any other user.\nS:U - The corruption and its consequences stay within the kernel's own security authority; there is no crossing of a VM, IOMMU, or other separate security boundary.\nC:H - The corrupted `q->active` head leaves a dangling pointer to the freed drr_class, and `drr_dequeue()` reads `cl->qdisc` out of that freed slab object, giving an attacker who resprays the slab a kernel-memory read primitive usable to disclose pointers and arbitrary data.\nI:H - This is memory corruption: `__list_add()` writes through the stale head into the freed class (`prev->next = new`), and `drr_dequeue()` performs an indirect call `cl->qdisc->ops->peek()` through freed, attacker-sprayable memory, yielding a write and control-flow hijack primitive for privilege escalation.\nA:H - The double list_add trips `CONFIG_DEBUG_LIST` BUG/warning immediately, and on production kernels the resulting list corruption and use-after-free reliably oops or panics the machine." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/sched/sch_drr.c" ], "versions": [ { "version": "37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea", "lessThan": "5da3aad1a13e7edb8ff0778a444ccf49930313e9", "status": "affected", "versionType": "git" }, { "version": "37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea", "lessThan": "4b07ac06b0a712923255aaf2691637693fc7100d", "status": "affected", "versionType": "git" }, { "version": "37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea", "lessThan": "2968632880f1792007eedd12eeedf7f6e2b7e9f3", "status": "affected", "versionType": "git" }, { "version": "37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea", "lessThan": "4f0ecf50cdf76da95828578a92f130b653ac2fcf", "status": "affected", "versionType": "git" }, { "version": "37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea", "lessThan": "db205b92dfe0501e5b92fb7cf00971d0e44ba3eb", "status": "affected", "versionType": "git" }, { "version": "37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea", "lessThan": "26e75716b94d6ff9be5ea07d63675c4d189f30b4", "status": "affected", "versionType": "git" }, { "version": "37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea", "lessThan": "ab2248110738d4429668140ad22f530a9ee730e1", "status": "affected", "versionType": "git" }, { "version": "37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea", "lessThan": "f99a3fbf023e20b626be4b0f042463d598050c9a", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/sched/sch_drr.c" ], "versions": [ { "version": "5.0", "status": "affected" }, { "version": "0", "lessThan": "5.0", "status": "unaffected", "versionType": "semver" }, { "version": "5.4.294", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.238", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.182", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.138", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.90", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.28", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.14.6", "lessThanOrEqual": "6.14.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.15", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.0", "versionEndExcluding": "5.4.294" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.0", "versionEndExcluding": "5.10.238" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.0", "versionEndExcluding": "5.15.182" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.0", "versionEndExcluding": "6.1.138" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.0", "versionEndExcluding": "6.6.90" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.0", "versionEndExcluding": "6.12.28" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.0", "versionEndExcluding": "6.14.6" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.0", "versionEndExcluding": "6.15" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/5da3aad1a13e7edb8ff0778a444ccf49930313e9" }, { "url": "https://git.kernel.org/stable/c/4b07ac06b0a712923255aaf2691637693fc7100d" }, { "url": "https://git.kernel.org/stable/c/2968632880f1792007eedd12eeedf7f6e2b7e9f3" }, { "url": "https://git.kernel.org/stable/c/4f0ecf50cdf76da95828578a92f130b653ac2fcf" }, { "url": "https://git.kernel.org/stable/c/db205b92dfe0501e5b92fb7cf00971d0e44ba3eb" }, { "url": "https://git.kernel.org/stable/c/26e75716b94d6ff9be5ea07d63675c4d189f30b4" }, { "url": "https://git.kernel.org/stable/c/ab2248110738d4429668140ad22f530a9ee730e1" }, { "url": "https://git.kernel.org/stable/c/f99a3fbf023e20b626be4b0f042463d598050c9a" } ], "title": "net_sched: drr: Fix double list add in class with netem as child qdisc", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "title": "CVE Program Container", "references": [ { "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html" }, { "url": "https://lists.debian.org/debian-lts-announce/2025/08/msg00010.html" } ], "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T19:57:17.858Z" } } ] } }