CVE-2025-37915Medium· 6.3▾ SunlitA flaw was found in the Linux kernel's Deficit Round Robin (DRR) network scheduling subsystem. When the scheduler is configured with a network emulator child queuing discipline, reentrant packet processing can cause an active list entry to…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 34.7 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the vendor's CSAF advisory record, not NVD.
Exploit-prediction probability, daily snapshots since Oct 15.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
0.2%
Last analysed / modified upstream
0.2% → 0.2%
7.8 → 6.3
high → medium
A flaw was found in the Linux kernel's Deficit Round Robin (DRR) network scheduling subsystem. When the scheduler is configured with a network emulator child queuing discipline, reentrant packet processing can cause an active list entry to be registered twice. A local user could exploit this issue to cause memory corruption, leading to a system crash and Denial of Service (DoS).
kernel: net_sched: drr: Fix double list add in class with netem as child qdisc — rated Moderate by Red Hat. Released 2025-05-20, updated 2026-10-16.
Affected:
No fix planned:
Not affected:
Out of support scope
Workarounds / mitigations:
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2025-37913Medium· 6.3kernel: net_sched: qfq: Fix double list add in class with netem as child qdisc (CVE-2025-37913)
CVE-2026-80706Medium· 5.5kernel: can: softing: fw_parse(): validate firmware record spans (CVE-2026-80706)
CVE-2026-97380High· 8.8mariadb: mariadb: Privilege escalation via empty password in GRANT PROXY statement (CVE-2026-97380)
CVE-2025-38440Medium· 4.7kernel: Linux kernel: Denial of Service due to race condition in mlx5e driver (CVE-2025-38440)
CVE-2026-86848High· 8.8A flaw was found in DPDK lib/vhost vhost-crypto
CVE-2026-95502Medium· 5.3A Git server that Grafana's Git Sync (provisioning) is configured to use can exhaust Grafana's memory by returning oversized or highly compressed responses (uncontrolled resource consumption)