CVE-2025-37914 — Double Free in Linux
Severity
7.8HIGHNVD
OSV8.8OSV3.2
EPSS
0.1%
top 74.58%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedMay 20
Latest updateMar 25
Description
In the Linux kernel, the following vulnerability has been resolved:
net_sched: ets: Fix double list add in class with netem as child qdisc
As described in Gerrard's report [1], there are use cases where a netem
child qdisc will make the parent qdisc's enqueue callback reentrant.
In the case of ets, there won't be a UAF, but the code will add the same
classifier to the list twice, which will cause memory corruption.
In addition to checking for qlen being zero, this patch checks whether
the cla…
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9
Affected Packages4 packages
▶CVEListV5linux/linuxdcc68b4d8084e1ac9af0d4022d6b1aff6a139a33 — 24388ba0a1b1b6d4af1b205927ac7f7b119ee4ea+7
Also affects: Debian Linux 11.0