CVE-2025-37915
Description
A flaw was found in the Linux kernel's Deficit Round Robin (DRR) network scheduling subsystem. When the scheduler is configured with a network emulator child queuing discipline, reentrant packet processing can cause an active list entry to be registered twice. A local user could exploit this issue to cause memory corruption, leading to a system crash and Denial of Service (DoS).
Statement
A moderate-severity vulnerability affects the Linux kernel's Deficit Round Robin (DRR) network scheduler (net_sched) in the kernel and kernel-rt packages shipped in Red Hat Enterprise Linux 8, and in the Hosted OpenShift offerings (OpenShift Dedicated and Azure Red Hat OpenShift) built on RHEL 8 kernels. When a DRR class is configured with a network emulator (netem) child qdisc, the netem child can make the parent qdisc's enqueue callback reentrant, causing the same class to be added to the active list twice. This double list insertion results in kernel memory corruption that can crash the system, causing a denial of service. Exploitation requires local access with the privileges needed to configure network traffic control; the flaw does not involve a use-after-free and has no confidentiality impact.
Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 10, and Red Hat In-Vehicle OS are not affected because the vulnerable code is not present in those kernels. Red Hat Enterprise Linux 6 and 7 are out of support scope.
The fix for the affected Red Hat Enterprise Linux 8 streams is deferred. The residual risk is limited because an attacker already needs local network-configuration privileges, the attack complexity is high, and the impact is memory corruption leading to a system crash (availability) rather than disclosure of information.
Red Hat rates this flaw as MODERATE (CVSS 6.3, CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H), which differs from the NIST rating of 7.0 and the CVE.org rating of 7.8; Red Hat's scoring reflects the local, privilege-requiring attack path with high attack complexity and no confidentiality impact.
Mitigation
This flaw is triggered only when a netem qdisc is attached as a child of a DRR class. As a workaround, avoid this configuration: remove or replace netem child qdiscs that are attached under a DRR parent qdisc, since without the netem child the DRR enqueue callback is not reentrant and a class cannot be added to the active list twice. There is no other mitigation available for affected systems at this time; apply kernel updates when a fix is released for the deferred streams.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 6.3 | 7 | 7.8 |
| Attack Vector | Local | Local | Local |
| Attack Complexity | High | High | Low |
| Privileges Required | Low | Low | Low |
| User Interaction | None | None | None |
| Scope | Unchanged | Unchanged | Unchanged |
| Confidentiality | None | High | High |
| Integrity Impact | High | High | High |
| Availability Impact | High | High | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H
NVD: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
cve.org: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
