Skip to content
Heist/ feed
High

net_sched: ets: Fix double list add in class with netem as child qdisc

Type: advisorySource: Official CVE List1 source record

In the Linux kernel, the following vulnerability has been resolved: net_sched: ets: Fix double list add in class with netem as child qdisc As described in Gerrard's report [1], there are use cases where a netem child qdisc will make the parent qdisc's enqueue callback reentrant. In the case of ets, there won't be a UAF, but the code will add the same classifier to the list twice, which will cause memory corruption. In addition to checking for qlen being zero, this patch checks whether the class was already added to the active_list (cl_is_active) before doing the addition to cater for the reentrant case. [1] https://lore.kernel.org/netdev/CAHcdcOm+03OD2j6R0=YHKqmy=VgJ8xEOKuP6c7mSgnp-TEJJbw@mail.gmail.com/

Announced Source revision 1
Original source ↗

CVE-2025-37914

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2025-37914

Linux

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Linux

Source reference: /containers/cna/affected/1/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "dcc68b4d8084e1ac9af0d4022d6b1aff6a139a33",
        "lessThan": "24388ba0a1b1b6d4af1b205927ac7f7b119ee4ea",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "dcc68b4d8084e1ac9af0d4022d6b1aff6a139a33",
        "lessThan": "554acc5a2ea9703e08023eb9a003f9e5a830a502",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "dcc68b4d8084e1ac9af0d4022d6b1aff6a139a33",
        "lessThan": "9efb6a0fa88e0910d079fdfeb4f7ce4d4ac6c990",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "dcc68b4d8084e1ac9af0d4022d6b1aff6a139a33",
        "lessThan": "72c3da7e6ceb74e74ddbb5a305a35c9fdfcac6e3",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "dcc68b4d8084e1ac9af0d4022d6b1aff6a139a33",
        "lessThan": "1f01e9f961605eb397c6ecd1d7b0233dfbf9077c",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "dcc68b4d8084e1ac9af0d4022d6b1aff6a139a33",
        "lessThan": "bc321f714de693aae06e3786f88df2975376d996",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "dcc68b4d8084e1ac9af0d4022d6b1aff6a139a33",
        "lessThan": "1a6d0c00fa07972384b0c308c72db091d49988b6",
        "versionType": "git"
      }
    ],
    "programFiles": [
      "net/sched/sch_ets.c"
    ],
    "defaultStatus": "unaffected"
  },
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "5.6"
      },
      {
        "status": "unaffected",
        "version": "0",
        "lessThan": "5.6",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "5.10.238",
        "versionType": "semver",
        "lessThanOrEqual": "5.10.*"
      },
      {
        "status": "unaffected",
        "version": "5.15.182",
        "versionType": "semver",
        "lessThanOrEqual": "5.15.*"
      },
      {
        "status": "unaffected",
        "version": "6.1.138",
        "versionType": "semver",
        "lessThanOrEqual": "6.1.*"
      },
      {
        "status": "unaffected",
        "version": "6.6.90",
        "versionType": "semver",
        "lessThanOrEqual": "6.6.*"
      },
      {
        "status": "unaffected",
        "version": "6.12.28",
        "versionType": "semver",
        "lessThanOrEqual": "6.12.*"
      },
      {
        "status": "unaffected",
        "version": "6.14.6",
        "versionType": "semver",
        "lessThanOrEqual": "6.14.*"
      },
      {
        "status": "unaffected",
        "version": "6.15",
        "versionType": "original_commit_for_fix",
        "lessThanOrEqual": "*"
      }
    ],
    "programFiles": [
      "net/sched/sch_ets.c"
    ],
    "defaultStatus": "affected"
  }
]
Related CVEs
CVE-2025-37914

Source reference: /cveMetadata/cveId

Publisher severity

high

Source reference: /containers/cna/metrics

Event
#30489 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement