CVE-2025-37913: Linux Kernel Use-After-Free Vulnerability

CVE-2025-37913 Overview

CVE-2025-37913 is a memory corruption vulnerability in the Linux kernel's Quick Fair Queueing (QFQ) packet scheduler. The flaw resides in the net_sched subsystem when a netem qdisc is configured as a child of a qfq parent qdisc. A netem child can make the parent's enqueue callback reentrant, causing the same classifier to be added to the agg->active list twice. This double list addition results in memory corruption within kernel-managed queue structures. The vulnerability is tracked under [CWE-415] (Double Free) and affects multiple Linux kernel versions including releases packaged in Debian Linux 11.

Critical Impact
A local, low-privileged user with the ability to configure network qdiscs (typically requiring CAP_NET_ADMIN) can trigger kernel memory corruption, leading to potential privilege escalation or denial of service.

Affected Products

Linux Kernel (multiple versions from 5.0 through 6.15-rc4)
Debian Linux 11
Systems using the qfq qdisc with netem as a child qdisc

Discovery Timeline

2025-05-20 - CVE-2025-37913 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-37913

Vulnerability Analysis

The vulnerability exists in the Quick Fair Queueing (QFQ) implementation within the Linux kernel's traffic control subsystem (net_sched). QFQ maintains classes that group traffic flows, and each class is tracked within an aggregate (agg) structure containing an active list of currently enqueued classifiers.

Under normal operation, the QFQ enqueue callback adds a class to the agg->active list exactly once per activation. However, when a netem (Network Emulator) qdisc is attached as a child of a qfq class, netem can invoke the parent's enqueue path recursively during packet processing. This reentrancy allows the same class to be added to the agg->active list a second time while it is still linked from the first insertion.

The result is a corrupted doubly-linked list containing the same node twice. Subsequent list traversal or removal operations then dereference stale or attacker-influenced pointers, producing memory corruption within the kernel heap. The upstream fix introduces a cl_is_active check to detect whether the class is already present on the agg->active list before adding it again.

Root Cause

The root cause is missing reentrancy protection in the QFQ enqueue path. The code assumed that a child qdisc would not call back into the parent's enqueue during the same operation. When netem reschedules packets, it violates this assumption and triggers the double list insertion.

Attack Vector

Exploitation requires local access and the privilege to create and configure qdiscs, typically CAP_NET_ADMIN in the acting network namespace. On systems where unprivileged user namespaces are enabled, an unprivileged user can obtain CAP_NET_ADMIN inside a new namespace and reach the vulnerable code path. An attacker constructs a qdisc hierarchy with qfq as the parent and netem as a child, then sends traffic that triggers the reentrant enqueue.

No public proof-of-concept exploit is currently listed for CVE-2025-37913, and the vulnerability is not present on the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2025-37913

Indicators of Compromise

Kernel oops or panic messages referencing qfq_enqueue, qfq_activate_agg, or list corruption warnings such as list_add corruption in dmesg output.
Unexpected creation of qfq qdiscs with netem child qdiscs by non-administrative processes.
Processes running with CAP_NET_ADMIN or creating new user namespaces followed by traffic control configuration syscalls.

Detection Strategies

Monitor kernel ring buffer output for list debugging warnings and slab corruption reports on hosts running affected kernel versions.
Audit tc qdisc command invocations and netlink traffic control messages via auditd rules on sys_sendmsg targeting AF_NETLINK sockets.
Track process behavior that combines user namespace creation with network configuration syscalls, a common pattern for reaching this attack surface.

Monitoring Recommendations

Enable kernel hardening options such as CONFIG_DEBUG_LIST and CONFIG_SLAB_FREELIST_HARDENED to surface list corruption earlier and reduce exploit reliability.
Forward kernel logs and audit events to a centralized SIEM for correlation of privilege-escalation indicators against affected hosts.
Inventory Linux kernel versions across the fleet and flag hosts running vulnerable versions of the kernel or Debian 11 without patched packages.

How to Mitigate CVE-2025-37913

Immediate Actions Required

Apply the vendor-supplied kernel updates for your distribution as soon as they are available.
On Debian 11, install the fixed kernel package announced in the Debian LTS Announcement (August 2025) and the follow-up Debian LTS Announcement (October 2025).
Restrict CAP_NET_ADMIN and disable unprivileged user namespaces where operational requirements permit, using sysctl kernel.unprivileged_userns_clone=0.

Patch Information

The upstream fix adds a cl_is_active check to prevent the duplicate list insertion. Patch commits are available on kernel.org, including commit 0aa23e08, commit a4378311, and commit f139f37d. Additional backports are listed in the NVD vendor references.

Workarounds

Prevent loading of the sch_qfq and sch_netem kernel modules on systems that do not require them by adding them to /etc/modprobe.d/blacklist.conf.
Remove any existing qdisc hierarchies that combine qfq as a parent with netem as a child by inspecting tc qdisc show output.
Disable unprivileged user namespaces to prevent non-root users from obtaining CAP_NET_ADMIN in a private namespace.

bash

# Configuration example: reduce exposure to CVE-2025-37913
# Disable unprivileged user namespaces
echo 'kernel.unprivileged_userns_clone=0' | sudo tee /etc/sysctl.d/99-userns.conf
sudo sysctl --system

# Blacklist vulnerable qdisc modules if unused
cat <<EOF | sudo tee /etc/modprobe.d/cve-2025-37913.conf
blacklist sch_qfq
blacklist sch_netem
EOF

# Verify no qfq/netem combination is currently configured
tc qdisc show | grep -E 'qfq|netem'