In the Linux kernel, the following vulnerability has been resolved:
net_sched: qfq: Fix double list add in class with netem as child qdisc
As described in Gerrard's report [1], there are use cases where a netem child qdisc will make the parent qdisc's enqueue callback reentrant. In the case of qfq, there won't be a UAF, but the code will add the same classifier to the list twice, which will cause memory corruption.
This patch checks whether the class was already added to the agg->active list (clisactive) before doing the addition to cater for the reentrant case.
[1] https://lore.kernel.org/netdev/CAHcdcOm+03OD2j6R0=YHKqmy=VgJ8xEOKuP6c7mSgnp-TEJJbw@mail.gmail.com/
[
    {
        "signature_version": "v1",
        "target": {
            "file": "net/sched/sch_qfq.c"
        },
        "id": "CVE-2025-37913-1086983d",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0bf32d6fb1fcbf841bb9945570e0e2a70072c00f",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "228584820916105178396683187057892915541",
                "135421759804663879386584736088535494675",
                "301409472606882015852105393545790431297",
                "234936136517880067298818847132911900522",
                "177650967531123338291723071069422550416",
                "192137957144886522894710440080113803182",
                "207679086135251807995279887819018356471",
                "175777895496461784463637172369039356938",
                "195334860178241667160819440537026166471",
                "236782014426852002919751828694070172714",
                "34387070716664109826932644077538038456",
                "187219484503161343441456949942772679585",
                "160107918459836775011760557040708823663",
                "110426273333783810225875587494175903834",
                "143879868912378887110763618739610918256"
            ]
        },
        "deprecated": false,
        "signature_type": "Line"
    },
    {
        "signature_version": "v1",
        "target": {
            "function": "qfq_enqueue",
            "file": "net/sched/sch_qfq.c"
        },
        "id": "CVE-2025-37913-1c652119",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0aa23e0856b7cedb3c88d8e3d281c212c7e4fbeb",
        "digest": {
            "function_hash": "217457828306127636164598784720408893534",
            "length": 1701.0
        },
        "deprecated": false,
        "signature_type": "Function"
    },
    {
        "signature_version": "v1",
        "target": {
            "function": "qfq_enqueue",
            "file": "net/sched/sch_qfq.c"
        },
        "id": "CVE-2025-37913-3f5f4906",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@005a479540478a820c52de098e5e767e63e36f0a",
        "digest": {
            "function_hash": "138022611986548428993252140489462817305",
            "length": 1722.0
        },
        "deprecated": false,
        "signature_type": "Function"
    },
    {
        "signature_version": "v1",
        "target": {
            "file": "net/sched/sch_qfq.c"
        },
        "id": "CVE-2025-37913-40a8064d",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a43783119e01849fbf2fe8855634e8989b240cb4",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "228584820916105178396683187057892915541",
                "135421759804663879386584736088535494675",
                "301409472606882015852105393545790431297",
                "234936136517880067298818847132911900522",
                "177650967531123338291723071069422550416",
                "192137957144886522894710440080113803182",
                "207679086135251807995279887819018356471",
                "175777895496461784463637172369039356938",
                "195334860178241667160819440537026166471",
                "236782014426852002919751828694070172714",
                "34387070716664109826932644077538038456",
                "187219484503161343441456949942772679585",
                "160107918459836775011760557040708823663",
                "110426273333783810225875587494175903834",
                "143879868912378887110763618739610918256"
            ]
        },
        "deprecated": false,
        "signature_type": "Line"
    },
    {
        "signature_version": "v1",
        "target": {
            "function": "qfq_enqueue",
            "file": "net/sched/sch_qfq.c"
        },
        "id": "CVE-2025-37913-45e9daa8",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@53bc0b55178bd59bdd4bcd16349505cabf54b1a2",
        "digest": {
            "function_hash": "217457828306127636164598784720408893534",
            "length": 1701.0
        },
        "deprecated": false,
        "signature_type": "Function"
    },
    {
        "signature_version": "v1",
        "target": {
            "function": "qfq_enqueue",
            "file": "net/sched/sch_qfq.c"
        },
        "id": "CVE-2025-37913-463b78e7",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a43783119e01849fbf2fe8855634e8989b240cb4",
        "digest": {
            "function_hash": "217457828306127636164598784720408893534",
            "length": 1701.0
        },
        "deprecated": false,
        "signature_type": "Function"
    },
    {
        "signature_version": "v1",
        "target": {
            "file": "net/sched/sch_qfq.c"
        },
        "id": "CVE-2025-37913-648c8cf3",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@53bc0b55178bd59bdd4bcd16349505cabf54b1a2",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "228584820916105178396683187057892915541",
                "135421759804663879386584736088535494675",
                "301409472606882015852105393545790431297",
                "234936136517880067298818847132911900522",
                "177650967531123338291723071069422550416",
                "192137957144886522894710440080113803182",
                "207679086135251807995279887819018356471",
                "175777895496461784463637172369039356938",
                "195334860178241667160819440537026166471",
                "236782014426852002919751828694070172714",
                "34387070716664109826932644077538038456",
                "187219484503161343441456949942772679585",
                "160107918459836775011760557040708823663",
                "110426273333783810225875587494175903834",
                "143879868912378887110763618739610918256"
            ]
        },
        "deprecated": false,
        "signature_type": "Line"
    },
    {
        "signature_version": "v1",
        "target": {
            "file": "net/sched/sch_qfq.c"
        },
        "id": "CVE-2025-37913-840b3643",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@005a479540478a820c52de098e5e767e63e36f0a",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "228584820916105178396683187057892915541",
                "135421759804663879386584736088535494675",
                "301409472606882015852105393545790431297",
                "234936136517880067298818847132911900522",
                "177650967531123338291723071069422550416",
                "192137957144886522894710440080113803182",
                "207679086135251807995279887819018356471",
                "175777895496461784463637172369039356938",
                "195334860178241667160819440537026166471",
                "236782014426852002919751828694070172714",
                "34387070716664109826932644077538038456",
                "187219484503161343441456949942772679585",
                "160107918459836775011760557040708823663",
                "110426273333783810225875587494175903834",
                "143879868912378887110763618739610918256"
            ]
        },
        "deprecated": false,
        "signature_type": "Line"
    },
    {
        "signature_version": "v1",
        "target": {
            "file": "net/sched/sch_qfq.c"
        },
        "id": "CVE-2025-37913-840d4579",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@370218e8ce711684acc4cdd3cc3c6dd7956bc165",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "228584820916105178396683187057892915541",
                "135421759804663879386584736088535494675",
                "301409472606882015852105393545790431297",
                "234936136517880067298818847132911900522",
                "177650967531123338291723071069422550416",
                "192137957144886522894710440080113803182",
                "207679086135251807995279887819018356471",
                "175777895496461784463637172369039356938",
                "195334860178241667160819440537026166471",
                "236782014426852002919751828694070172714",
                "34387070716664109826932644077538038456",
                "187219484503161343441456949942772679585",
                "160107918459836775011760557040708823663",
                "110426273333783810225875587494175903834",
                "143879868912378887110763618739610918256"
            ]
        },
        "deprecated": false,
        "signature_type": "Line"
    },
    {
        "signature_version": "v1",
        "target": {
            "function": "qfq_enqueue",
            "file": "net/sched/sch_qfq.c"
        },
        "id": "CVE-2025-37913-a14f5ded",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f139f37dcdf34b67f5bf92bc8e0f7f6b3ac63aa4",
        "digest": {
            "function_hash": "217457828306127636164598784720408893534",
            "length": 1701.0
        },
        "deprecated": false,
        "signature_type": "Function"
    },
    {
        "signature_version": "v1",
        "target": {
            "function": "qfq_enqueue",
            "file": "net/sched/sch_qfq.c"
        },
        "id": "CVE-2025-37913-a8878b49",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0bf32d6fb1fcbf841bb9945570e0e2a70072c00f",
        "digest": {
            "function_hash": "138022611986548428993252140489462817305",
            "length": 1722.0
        },
        "deprecated": false,
        "signature_type": "Function"
    },
    {
        "signature_version": "v1",
        "target": {
            "function": "qfq_enqueue",
            "file": "net/sched/sch_qfq.c"
        },
        "id": "CVE-2025-37913-cfa56580",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@370218e8ce711684acc4cdd3cc3c6dd7956bc165",
        "digest": {
            "function_hash": "217457828306127636164598784720408893534",
            "length": 1701.0
        },
        "deprecated": false,
        "signature_type": "Function"
    },
    {
        "signature_version": "v1",
        "target": {
            "file": "net/sched/sch_qfq.c"
        },
        "id": "CVE-2025-37913-db2b8310",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f139f37dcdf34b67f5bf92bc8e0f7f6b3ac63aa4",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "228584820916105178396683187057892915541",
                "135421759804663879386584736088535494675",
                "301409472606882015852105393545790431297",
                "234936136517880067298818847132911900522",
                "177650967531123338291723071069422550416",
                "192137957144886522894710440080113803182",
                "207679086135251807995279887819018356471",
                "175777895496461784463637172369039356938",
                "195334860178241667160819440537026166471",
                "236782014426852002919751828694070172714",
                "34387070716664109826932644077538038456",
                "187219484503161343441456949942772679585",
                "160107918459836775011760557040708823663",
                "110426273333783810225875587494175903834",
                "143879868912378887110763618739610918256"
            ]
        },
        "deprecated": false,
        "signature_type": "Line"
    },
    {
        "signature_version": "v1",
        "target": {
            "file": "net/sched/sch_qfq.c"
        },
        "id": "CVE-2025-37913-e1ad0ed7",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0aa23e0856b7cedb3c88d8e3d281c212c7e4fbeb",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "228584820916105178396683187057892915541",
                "135421759804663879386584736088535494675",
                "301409472606882015852105393545790431297",
                "234936136517880067298818847132911900522",
                "177650967531123338291723071069422550416",
                "192137957144886522894710440080113803182",
                "207679086135251807995279887819018356471",
                "175777895496461784463637172369039356938",
                "195334860178241667160819440537026166471",
                "236782014426852002919751828694070172714",
                "34387070716664109826932644077538038456",
                "187219484503161343441456949942772679585",
                "160107918459836775011760557040708823663",
                "110426273333783810225875587494175903834",
                "143879868912378887110763618739610918256"
            ]
        },
        "deprecated": false,
        "signature_type": "Line"
    }
]