Bug 2367500 (CVE-2025-37914)

Summary:	CVE-2025-37914 kernel: net_sched: ets: Fix double list add in class with netem as child qdisc
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	dfreiber, drow, jburrell, vkumar
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A use-after-free vulnerability was found in the Linux kernel’s `netem` qdisc. This issue occurs when it incorrectly manages duplicated packets in classful parent qdiscs. This leads to a corrupted internal state and eventual dereferencing of freed memory, resulting in unpredictable behavior, system instability, or a crash.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2025-05-20 16:01:14 UTC

In the Linux kernel, the following vulnerability has been resolved:

net_sched: ets: Fix double list add in class with netem as child qdisc

As described in Gerrard's report [1], there are use cases where a netem
child qdisc will make the parent qdisc's enqueue callback reentrant.
In the case of ets, there won't be a UAF, but the code will add the same
classifier to the list twice, which will cause memory corruption.

In addition to checking for qlen being zero, this patch checks whether
the class was already added to the active_list (cl_is_active) before
doing the addition to cater for the reentrant case.

[1] https://lore.kernel.org/netdev/CAHcdcOm+03OD2j6R0=YHKqmy=VgJ8xEOKuP6c7mSgnp-TEJJbw@mail.gmail.com/

Comment 1 Jon Moroney 2025-05-20 19:43:08 UTC

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2025052000-CVE-2025-37914-1a4f@gregkh/T

Comment 6 errata-xmlrpc 2025-08-18 02:46:32 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2025:13961 https://access.redhat.com/errata/RHSA-2025:13961

Comment 7 errata-xmlrpc 2025-08-18 02:47:46 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2025:13960 https://access.redhat.com/errata/RHSA-2025:13960

Comment 9 errata-xmlrpc 2025-08-25 07:57:04 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2025:14420 https://access.redhat.com/errata/RHSA-2025:14420

Comment 10 errata-xmlrpc 2025-08-25 13:58:36 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2025:14510 https://access.redhat.com/errata/RHSA-2025:14510

Comment 11 errata-xmlrpc 2025-09-11 06:36:04 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Extended Update Support

Via RHSA-2025:15668 https://access.redhat.com/errata/RHSA-2025:15668

Comment 15 errata-xmlrpc 2025-10-08 15:12:02 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.8 Telecommunications Update Service

Via RHSA-2025:17570 https://access.redhat.com/errata/RHSA-2025:17570

Comment 16 errata-xmlrpc 2025-10-13 00:13:05 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

Via RHSA-2025:17735 https://access.redhat.com/errata/RHSA-2025:17735

Comment 17 errata-xmlrpc 2025-10-13 00:22:47 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

Via RHSA-2025:17734 https://access.redhat.com/errata/RHSA-2025:17734

Comment 18 errata-xmlrpc 2025-10-15 00:24:53 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.6 Telecommunications Update Service

Via RHSA-2025:18043 https://access.redhat.com/errata/RHSA-2025:18043

Comment 19 errata-xmlrpc 2025-10-15 07:05:07 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions

Via RHSA-2025:18054 https://access.redhat.com/errata/RHSA-2025:18054

Comment 20 errata-xmlrpc 2025-10-15 11:36:47 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions

Via RHSA-2025:18098 https://access.redhat.com/errata/RHSA-2025:18098