In the Linux kernel, the following vulnerability has been resolved:
net_sched: ets: Fix double list add in class with netem as child qdisc
As described in Gerrard's report [1], there are use cases where a netem child qdisc will make the parent qdisc's enqueue callback reentrant. In the case of ets, there won't be a UAF, but the code will add the same classifier to the list twice, which will cause memory corruption.
In addition to checking for qlen being zero, this patch checks whether the class was already added to the activelist (clis_active) before doing the addition to cater for the reentrant case.
[1] https://lore.kernel.org/netdev/CAHcdcOm+03OD2j6R0=YHKqmy=VgJ8xEOKuP6c7mSgnp-TEJJbw@mail.gmail.com/
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9efb6a0fa88e0910d079fdfeb4f7ce4d4ac6c990",
"target": {
"file": "net/sched/sch_ets.c",
"function": "ets_qdisc_enqueue"
},
"id": "CVE-2025-37914-03f49e94",
"digest": {
"function_hash": "159904220197880154218627505981276973667",
"length": 772.0
},
"signature_version": "v1",
"signature_type": "Function",
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@554acc5a2ea9703e08023eb9a003f9e5a830a502",
"target": {
"file": "net/sched/sch_ets.c",
"function": "ets_qdisc_enqueue"
},
"id": "CVE-2025-37914-12e297c1",
"digest": {
"function_hash": "159904220197880154218627505981276973667",
"length": 772.0
},
"signature_version": "v1",
"signature_type": "Function",
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1a6d0c00fa07972384b0c308c72db091d49988b6",
"target": {
"file": "net/sched/sch_ets.c",
"function": "ets_qdisc_enqueue"
},
"id": "CVE-2025-37914-31479aea",
"digest": {
"function_hash": "159904220197880154218627505981276973667",
"length": 772.0
},
"signature_version": "v1",
"signature_type": "Function",
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@24388ba0a1b1b6d4af1b205927ac7f7b119ee4ea",
"target": {
"file": "net/sched/sch_ets.c"
},
"id": "CVE-2025-37914-3b4805ce",
"digest": {
"line_hashes": [
"144320259029163469706301855518850669715",
"63498857578447521713909299412127917719",
"22307809460710151580765447231521746992",
"52870918027342384393843942085782313689",
"305366722537725317781616156161020150829",
"29984703918226974503570238946094962869",
"128759985574598976809381760197854399487",
"140974099743271624036611059627572982197",
"252558819941388581288706271153214883799",
"243188693581562688663333988066934983016",
"92489964873688335771792690573631218899",
"86273732610102086858897926409697259969",
"46062219420957453816847849275936059210",
"20368752408042010566049358619599115959",
"46729071570797860454703765887060007798"
],
"threshold": 0.9
},
"signature_version": "v1",
"signature_type": "Line",
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1f01e9f961605eb397c6ecd1d7b0233dfbf9077c",
"target": {
"file": "net/sched/sch_ets.c"
},
"id": "CVE-2025-37914-61abe989",
"digest": {
"line_hashes": [
"144320259029163469706301855518850669715",
"63498857578447521713909299412127917719",
"22307809460710151580765447231521746992",
"52870918027342384393843942085782313689",
"305366722537725317781616156161020150829",
"29984703918226974503570238946094962869",
"128759985574598976809381760197854399487",
"140974099743271624036611059627572982197",
"252558819941388581288706271153214883799",
"243188693581562688663333988066934983016",
"92489964873688335771792690573631218899",
"86273732610102086858897926409697259969",
"46062219420957453816847849275936059210",
"20368752408042010566049358619599115959",
"46729071570797860454703765887060007798"
],
"threshold": 0.9
},
"signature_version": "v1",
"signature_type": "Line",
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9efb6a0fa88e0910d079fdfeb4f7ce4d4ac6c990",
"target": {
"file": "net/sched/sch_ets.c"
},
"id": "CVE-2025-37914-6365fc77",
"digest": {
"line_hashes": [
"144320259029163469706301855518850669715",
"63498857578447521713909299412127917719",
"22307809460710151580765447231521746992",
"52870918027342384393843942085782313689",
"305366722537725317781616156161020150829",
"29984703918226974503570238946094962869",
"128759985574598976809381760197854399487",
"140974099743271624036611059627572982197",
"252558819941388581288706271153214883799",
"243188693581562688663333988066934983016",
"92489964873688335771792690573631218899",
"86273732610102086858897926409697259969",
"46062219420957453816847849275936059210",
"20368752408042010566049358619599115959",
"46729071570797860454703765887060007798"
],
"threshold": 0.9
},
"signature_version": "v1",
"signature_type": "Line",
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1f01e9f961605eb397c6ecd1d7b0233dfbf9077c",
"target": {
"file": "net/sched/sch_ets.c",
"function": "ets_qdisc_enqueue"
},
"id": "CVE-2025-37914-655737d7",
"digest": {
"function_hash": "159904220197880154218627505981276973667",
"length": 772.0
},
"signature_version": "v1",
"signature_type": "Function",
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bc321f714de693aae06e3786f88df2975376d996",
"target": {
"file": "net/sched/sch_ets.c"
},
"id": "CVE-2025-37914-67962955",
"digest": {
"line_hashes": [
"144320259029163469706301855518850669715",
"63498857578447521713909299412127917719",
"22307809460710151580765447231521746992",
"52870918027342384393843942085782313689",
"305366722537725317781616156161020150829",
"29984703918226974503570238946094962869",
"128759985574598976809381760197854399487",
"140974099743271624036611059627572982197",
"252558819941388581288706271153214883799",
"243188693581562688663333988066934983016",
"92489964873688335771792690573631218899",
"86273732610102086858897926409697259969",
"46062219420957453816847849275936059210",
"20368752408042010566049358619599115959",
"46729071570797860454703765887060007798"
],
"threshold": 0.9
},
"signature_version": "v1",
"signature_type": "Line",
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@72c3da7e6ceb74e74ddbb5a305a35c9fdfcac6e3",
"target": {
"file": "net/sched/sch_ets.c"
},
"id": "CVE-2025-37914-a01453ec",
"digest": {
"line_hashes": [
"144320259029163469706301855518850669715",
"63498857578447521713909299412127917719",
"22307809460710151580765447231521746992",
"52870918027342384393843942085782313689",
"305366722537725317781616156161020150829",
"29984703918226974503570238946094962869",
"128759985574598976809381760197854399487",
"140974099743271624036611059627572982197",
"252558819941388581288706271153214883799",
"243188693581562688663333988066934983016",
"92489964873688335771792690573631218899",
"86273732610102086858897926409697259969",
"46062219420957453816847849275936059210",
"20368752408042010566049358619599115959",
"46729071570797860454703765887060007798"
],
"threshold": 0.9
},
"signature_version": "v1",
"signature_type": "Line",
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@72c3da7e6ceb74e74ddbb5a305a35c9fdfcac6e3",
"target": {
"file": "net/sched/sch_ets.c",
"function": "ets_qdisc_enqueue"
},
"id": "CVE-2025-37914-aa4cbb47",
"digest": {
"function_hash": "159904220197880154218627505981276973667",
"length": 772.0
},
"signature_version": "v1",
"signature_type": "Function",
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@24388ba0a1b1b6d4af1b205927ac7f7b119ee4ea",
"target": {
"file": "net/sched/sch_ets.c",
"function": "ets_qdisc_enqueue"
},
"id": "CVE-2025-37914-b57a70cd",
"digest": {
"function_hash": "159904220197880154218627505981276973667",
"length": 772.0
},
"signature_version": "v1",
"signature_type": "Function",
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1a6d0c00fa07972384b0c308c72db091d49988b6",
"target": {
"file": "net/sched/sch_ets.c"
},
"id": "CVE-2025-37914-cdceb242",
"digest": {
"line_hashes": [
"144320259029163469706301855518850669715",
"63498857578447521713909299412127917719",
"22307809460710151580765447231521746992",
"52870918027342384393843942085782313689",
"305366722537725317781616156161020150829",
"29984703918226974503570238946094962869",
"128759985574598976809381760197854399487",
"140974099743271624036611059627572982197",
"252558819941388581288706271153214883799",
"243188693581562688663333988066934983016",
"92489964873688335771792690573631218899",
"86273732610102086858897926409697259969",
"46062219420957453816847849275936059210",
"20368752408042010566049358619599115959",
"46729071570797860454703765887060007798"
],
"threshold": 0.9
},
"signature_version": "v1",
"signature_type": "Line",
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@554acc5a2ea9703e08023eb9a003f9e5a830a502",
"target": {
"file": "net/sched/sch_ets.c"
},
"id": "CVE-2025-37914-d30b5c57",
"digest": {
"line_hashes": [
"144320259029163469706301855518850669715",
"63498857578447521713909299412127917719",
"22307809460710151580765447231521746992",
"52870918027342384393843942085782313689",
"305366722537725317781616156161020150829",
"29984703918226974503570238946094962869",
"128759985574598976809381760197854399487",
"140974099743271624036611059627572982197",
"252558819941388581288706271153214883799",
"243188693581562688663333988066934983016",
"92489964873688335771792690573631218899",
"86273732610102086858897926409697259969",
"46062219420957453816847849275936059210",
"20368752408042010566049358619599115959",
"46729071570797860454703765887060007798"
],
"threshold": 0.9
},
"signature_version": "v1",
"signature_type": "Line",
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bc321f714de693aae06e3786f88df2975376d996",
"target": {
"file": "net/sched/sch_ets.c",
"function": "ets_qdisc_enqueue"
},
"id": "CVE-2025-37914-ef199a96",
"digest": {
"function_hash": "159904220197880154218627505981276973667",
"length": 772.0
},
"signature_version": "v1",
"signature_type": "Function",
"deprecated": false
}
]