Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2025-37913

net_sched: qfq: Fix double list add in class with netem as child qdisc

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 5.4.294, 5.10.238, 5.15.182, 6.1.138, 6.6.90, and 2 more
None on Exploit-DB, Metasploit or GitHub
  • Exploitation: none
  • Automatable: no
  • Technical impact: total

Summary

In the Linux kernel, the following vulnerability has been resolved: net_sched: qfq: Fix double list add in class with netem as child qdisc As described in Gerrard's report [1], there are use cases where a netem child qdisc will make the parent qdisc's enqueue callback reentrant. In the case of qfq, there won't be a UAF, but the code will add the same classifier to the list twice, which will cause memory corruption. This patch checks whether the class was already added to the agg->active list (cl_is_active) before doing the addition to cater for the reentrant case. [1] https://lore.kernel.org/netdev/CAHcdcOm+03OD2j6R0=YHKqmy=VgJ8xEOKuP6c7mSgnp-TEJJbw@mail.gmail.com/

Timeline

  1. CVE published
  2. CISA SSVC assessment

    Exploitation: none · Automatable: no · Technical impact: total

  3. Record last updated

Affected versions

  • Linux Linux

    From 37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea · fixed in 041f410aec2c1751ee22b8b73ba05d38c3a6a602; From 37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea · fixed in 005a479540478a820c52de098e5e767e63e36f0a; From 37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea · fixed in 0bf32d6fb1fcbf841bb9945570e0e2a70072c00f; From 37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea · fixed in 0aa23e0856b7cedb3c88d8e3d281c212c7e4fbeb; From 37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea · fixed in a43783119e01849fbf2fe8855634e8989b240cb4; From 37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea · fixed in 53bc0b55178bd59bdd4bcd16349505cabf54b1a2; From 37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea · fixed in 370218e8ce711684acc4cdd3cc3c6dd7956bc165; From 37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea · fixed in f139f37dcdf34b67f5bf92bc8e0f7f6b3ac63aa4

  • Linux Linux

    5.0

  • KernelLinux

    From 5.0.0 · fixed in 5.4.294; From 5.5.0 · fixed in 5.10.238; From 5.11.0 · fixed in 5.15.182; From 5.16.0 · fixed in 6.1.138; From 6.2.0 · fixed in 6.6.90; From 6.7.0 · fixed in 6.12.28; From 6.13.0 · fixed in 6.14.6

References 8

git.kernel.org