Bug 2367500 (CVE-2025-37914) - CVE-2025-37914 kernel: net_sched: ets: Fix double list add in class with netem as child qdisc
Summary: CVE-2025-37914 kernel: net_sched: ets: Fix double list add in class with nete...
Keywords:
Status: NEW
Alias: CVE-2025-37914
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2025-05-20 16:01 UTC by OSIDB Bzimport
Modified: 2025-11-12 02:38 UTC (History)
4 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2025:13960 0 None None None 2025-08-18 02:47:48 UTC
Red Hat Product Errata RHSA-2025:13961 0 None None None 2025-08-18 02:46:33 UTC
Red Hat Product Errata RHSA-2025:14420 0 None None None 2025-08-25 07:57:05 UTC
Red Hat Product Errata RHSA-2025:14510 0 None None None 2025-08-25 13:58:37 UTC
Red Hat Product Errata RHSA-2025:15668 0 None None None 2025-09-11 06:36:05 UTC
Red Hat Product Errata RHSA-2025:17570 0 None None None 2025-10-08 15:12:04 UTC
Red Hat Product Errata RHSA-2025:17734 0 None None None 2025-10-13 00:22:49 UTC
Red Hat Product Errata RHSA-2025:17735 0 None None None 2025-10-13 00:13:06 UTC
Red Hat Product Errata RHSA-2025:18043 0 None None None 2025-10-15 00:24:54 UTC
Red Hat Product Errata RHSA-2025:18054 0 None None None 2025-10-15 07:05:08 UTC
Red Hat Product Errata RHSA-2025:18098 0 None None None 2025-10-15 11:36:49 UTC

Description OSIDB Bzimport 2025-05-20 16:01:14 UTC 
In the Linux kernel, the following vulnerability has been resolved:

net_sched: ets: Fix double list add in class with netem as child qdisc

As described in Gerrard's report [1], there are use cases where a netem
child qdisc will make the parent qdisc's enqueue callback reentrant.
In the case of ets, there won't be a UAF, but the code will add the same
classifier to the list twice, which will cause memory corruption.

In addition to checking for qlen being zero, this patch checks whether
the class was already added to the active_list (cl_is_active) before
doing the addition to cater for the reentrant case.

[1] https://lore.kernel.org/netdev/CAHcdcOm+03OD2j6R0=YHKqmy=VgJ8xEOKuP6c7mSgnp-TEJJbw@mail.gmail.com/
Comment 1 Jon Moroney 2025-05-20 19:43:08 UTC 
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2025052000-CVE-2025-37914-1a4f@gregkh/T
Comment 6 errata-xmlrpc 2025-08-18 02:46:32 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2025:13961 https://access.redhat.com/errata/RHSA-2025:13961
Comment 7 errata-xmlrpc 2025-08-18 02:47:46 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2025:13960 https://access.redhat.com/errata/RHSA-2025:13960
Comment 9 errata-xmlrpc 2025-08-25 07:57:04 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2025:14420 https://access.redhat.com/errata/RHSA-2025:14420
Comment 10 errata-xmlrpc 2025-08-25 13:58:36 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2025:14510 https://access.redhat.com/errata/RHSA-2025:14510
Comment 11 errata-xmlrpc 2025-09-11 06:36:04 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Extended Update Support

Via RHSA-2025:15668 https://access.redhat.com/errata/RHSA-2025:15668
Comment 15 errata-xmlrpc 2025-10-08 15:12:02 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.8 Telecommunications Update Service

Via RHSA-2025:17570 https://access.redhat.com/errata/RHSA-2025:17570
Comment 16 errata-xmlrpc 2025-10-13 00:13:05 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

Via RHSA-2025:17735 https://access.redhat.com/errata/RHSA-2025:17735
Comment 17 errata-xmlrpc 2025-10-13 00:22:47 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

Via RHSA-2025:17734 https://access.redhat.com/errata/RHSA-2025:17734
Comment 18 errata-xmlrpc 2025-10-15 00:24:53 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.6 Telecommunications Update Service

Via RHSA-2025:18043 https://access.redhat.com/errata/RHSA-2025:18043
Comment 19 errata-xmlrpc 2025-10-15 07:05:07 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions

Via RHSA-2025:18054 https://access.redhat.com/errata/RHSA-2025:18054
Comment 20 errata-xmlrpc 2025-10-15 11:36:47 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions

Via RHSA-2025:18098 https://access.redhat.com/errata/RHSA-2025:18098
Note You need to log in before you can comment on or make changes to this bug.