{"id":"CVE-2025-37915","title":"kernel: net_sched: drr: Fix double list add in class with netem as child qdisc (CVE-2025-37915)","summary":"A flaw was found in the Linux kernel's Deficit Round Robin (DRR) network scheduling subsystem. When the scheduler is configured with a network emulator child queuing discipline, reentrant packet processing can cause an active list entry to…","severity":"medium","cvss":6.3,"cvssVector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H","cvssSource":"vendor","cwe":"CWE-367","vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","affected":["enterprise_linux 6","enterprise_linux 7","enterprise_linux 8"],"published":"2025-05-20","updated":"2026-10-16","sourceUpdated":"2026-10-16T18:34:13+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-37915.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-37915.json"},{"url":"https://access.redhat.com/security/cve/CVE-2025-37915"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2367527"},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-37915"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-37915"},{"url":"https://lore.kernel.org/linux-cve-announce/2025052000-CVE-2025-37915-83e3@gregkh/T"},{"url":"https://git.kernel.org/stable/c/5da3aad1a13e7edb8ff0778a444ccf49930313e9"},{"url":"https://git.kernel.org/stable/c/4b07ac06b0a712923255aaf2691637693fc7100d"},{"url":"https://git.kernel.org/stable/c/2968632880f1792007eedd12eeedf7f6e2b7e9f3"},{"url":"https://git.kernel.org/stable/c/4f0ecf50cdf76da95828578a92f130b653ac2fcf"},{"url":"https://git.kernel.org/stable/c/db205b92dfe0501e5b92fb7cf00971d0e44ba3eb"},{"url":"https://git.kernel.org/stable/c/26e75716b94d6ff9be5ea07d63675c4d189f30b4"},{"url":"https://git.kernel.org/stable/c/ab2248110738d4429668140ad22f530a9ee730e1"},{"url":"https://git.kernel.org/stable/c/f99a3fbf023e20b626be4b0f042463d598050c9a"}],"tags":["csaf","vex","red-hat","cve.org"],"epss":0.00225,"epssPercentile":0.12406,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-15T21:45:59.473711Z"},"scores":{"vendor":6.3,"cna":7.8},"ingestedAt":"2026-10-15T22:48:25.483Z","slug":"CVE-2025-37915","body":"## Overview\n\nA flaw was found in the Linux kernel's Deficit Round Robin (DRR) network scheduling subsystem. When the scheduler is configured with a network emulator child queuing discipline, reentrant packet processing can cause an active list entry to be registered twice. A local user could exploit this issue to cause memory corruption, leading to a system crash and Denial of Service (DoS).\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8 · updated 2026-10-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-37915.json)\n\n**kernel: net_sched: drr: Fix double list add in class with netem as child qdisc** — rated Moderate by Red Hat. Released 2025-05-20, updated 2026-10-16.\n\nAffected:\n\n- Red Hat Enterprise Linux 6\n- Red Hat Enterprise Linux 7\n- Red Hat Enterprise Linux 8\n\nNo fix planned:\n\n- Red Hat Enterprise Linux 6\n- Red Hat Enterprise Linux 7\n- Red Hat Enterprise Linux 8\n\nNot affected:\n\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 9\n\n## Remediation\n\nOut of support scope\n\nWorkarounds / mitigations:\n\n- This flaw is triggered only when a netem qdisc is attached as a child of a DRR class. As a workaround, avoid this configuration: remove or replace netem child qdiscs that are attached under a DRR parent qdisc, since without the netem child the DRR enqueue callback is not reentrant and a class cannot be added to the active list twice. There is no other mitigation available for affected systems at this time; apply kernel updates when a fix is released for the deferred streams.","depth":"sunlit","depthScore":35,"depthScoreParts":{"impact":34.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":222959,"id":"CVE-2025-37915","ts":1792151815112,"field":"cvss","old":"7.8","new":"6.3"},{"seq":222958,"id":"CVE-2025-37915","ts":1792151815112,"field":"severity","old":"high","new":"medium"}]}