---
id: CVE-2025-37915
title: >-
  kernel: net_sched: drr: Fix double list add in class with netem as child qdisc
  (CVE-2025-37915)
summary: >-
  A flaw was found in the Linux kernel's Deficit Round Robin (DRR) network
  scheduling subsystem. When the scheduler is configured with a network emulator
  child queuing discipline, reentrant packet processing can cause an active list
  entry to…
severity: medium
cvss: 6.3
cvssVector: 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H'
cvssSource: vendor
cwe: CWE-367
vendor: Red Hat
product: Red Hat Enterprise Linux 8
affected:
  - enterprise_linux 6
  - enterprise_linux 7
  - enterprise_linux 8
published: '2025-05-20'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T18:34:13+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-37915.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-37915.json
  - url: 'https://access.redhat.com/security/cve/CVE-2025-37915'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2367527'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2025-37915'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2025-37915'
  - url: >-
      https://lore.kernel.org/linux-cve-announce/2025052000-CVE-2025-37915-83e3@gregkh/T
  - url: 'https://git.kernel.org/stable/c/5da3aad1a13e7edb8ff0778a444ccf49930313e9'
  - url: 'https://git.kernel.org/stable/c/4b07ac06b0a712923255aaf2691637693fc7100d'
  - url: 'https://git.kernel.org/stable/c/2968632880f1792007eedd12eeedf7f6e2b7e9f3'
  - url: 'https://git.kernel.org/stable/c/4f0ecf50cdf76da95828578a92f130b653ac2fcf'
  - url: 'https://git.kernel.org/stable/c/db205b92dfe0501e5b92fb7cf00971d0e44ba3eb'
  - url: 'https://git.kernel.org/stable/c/26e75716b94d6ff9be5ea07d63675c4d189f30b4'
  - url: 'https://git.kernel.org/stable/c/ab2248110738d4429668140ad22f530a9ee730e1'
  - url: 'https://git.kernel.org/stable/c/f99a3fbf023e20b626be4b0f042463d598050c9a'
tags:
  - csaf
  - vex
  - red-hat
  - cve.org
epss: 0.00225
epssPercentile: 0.12406
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-15T21:45:59.473711Z'
scores:
  vendor: 6.3
  cna: 7.8
ingestedAt: '2026-10-15T22:48:25.483Z'
---

## Overview

A flaw was found in the Linux kernel's Deficit Round Robin (DRR) network scheduling subsystem. When the scheduler is configured with a network emulator child queuing discipline, reentrant packet processing can cause an active list entry to be registered twice. A local user could exploit this issue to cause memory corruption, leading to a system crash and Denial of Service (DoS).

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8 · updated 2026-10-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-37915.json)

**kernel: net_sched: drr: Fix double list add in class with netem as child qdisc** — rated Moderate by Red Hat. Released 2025-05-20, updated 2026-10-16.

Affected:

- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8

No fix planned:

- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8

Not affected:

- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 9

## Remediation

Out of support scope

Workarounds / mitigations:

- This flaw is triggered only when a netem qdisc is attached as a child of a DRR class. As a workaround, avoid this configuration: remove or replace netem child qdiscs that are attached under a DRR parent qdisc, since without the netem child the DRR enqueue callback is not reentrant and a class cannot be added to the active list twice. There is no other mitigation available for affected systems at this time; apply kernel updates when a fix is released for the deferred streams.