Memory Corruption Vulnerability in Linux Kernel - CVE-2025-37915
Summary
CVE-2025-37915: In the Linux kernel, the following vulnerability has been resolved: net_sched: drr: Fix double list add in class with netem as child qdisc As described in Gerrard's report [1], there are use cases where a netem child qdi... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing hardware resources and providing essential services to applications. It is widely used in various environments, from servers to embedded systems. This vulnerability affects the scheduling subsystem of the kernel, specifically the 'drr' (Deficit Round Robin) scheduler when used with 'netem' (Network Emulator) as a child queuing discipline.
Vulnerability Detail
CVE-2025-37915 is a vulnerability in the Linux kernel's net_sched subsystem that can lead to memory corruption. The issue arises when a netem child qdisc makes the parent qdisc's enqueue callback reentrant. Although this does not lead to a use-after-free (UAF) condition, it allows the same classifier to be added to the active list twice, resulting in potential memory corruption. This vulnerability was reported by Gerrard and has been addressed in a patch that checks if the class is already in the active list before adding it again.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, if immediate patching is not possible, consider disabling the netem child qdisc or using an alternative queuing discipline until the patch can be applied. This can be done by modifying the network configuration to avoid using netem in conjunction with drr.
Conclusion
CVE-2025-37915 is a significant vulnerability in the Linux kernel that can lead to memory corruption under specific conditions. It is crucial for users of affected Debian versions to apply the necessary updates to mitigate the risk. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for linux →
FAQ
CVE-2025-37915 is a vulnerability in the Linux kernel that can cause memory corruption due to improper handling of the scheduling subsystem.
If your system uses the affected versions of the Linux kernel with netem and drr, it could lead to memory corruption, potentially impacting system stability.
Versions of the Linux kernel in Debian 11, 12, and 13 are affected. Check your kernel version using 'uname -r' in the terminal.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
Consider disabling the netem child qdisc or using an alternative queuing discipline as a temporary workaround until the patch is applied.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
