CVE-2025-37914: Linux Kernel Use-After-Free Vulnerability

CVE-2025-37914 Overview

CVE-2025-37914 is a memory corruption vulnerability in the Linux kernel's net_sched subsystem, specifically in the Enhanced Transmission Selection (ETS) queueing discipline. The flaw occurs when a netem child qdisc makes the parent qdisc's enqueue callback reentrant. Under these conditions, the ETS scheduler adds the same classifier to its active_list twice, corrupting the linked list. The issue affects Linux kernel builds including 6.15-rc1 through 6.15-rc4, as well as Debian Linux distributions. The vulnerability is tracked under CWE-415 (Double Free) semantics for list membership.

Critical Impact
A local, low-privileged user with the ability to configure network queueing disciplines can trigger kernel memory corruption, leading to privilege escalation, denial of service, or arbitrary kernel code execution.

Affected Products

Linux Kernel (multiple stable branches, including 6.15-rc1 through 6.15-rc4)
Debian Linux 11.0
Distributions shipping affected kernel versions with the sch_ets and sch_netem modules enabled

Discovery Timeline

2025-05-20 - CVE-2025-37914 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-37914

Vulnerability Analysis

The vulnerability resides in the sch_ets queueing discipline of the Linux kernel networking stack. ETS maintains an active_list tracking classes with packets ready for transmission. When a class enqueues its first packet, the ETS enqueue path adds it to active_list based on a check that its queue length (qlen) is zero. The logic assumed this enqueue operation was non-reentrant.

When netem is configured as the child qdisc of an ETS class, netem can invoke the parent's enqueue callback recursively during packet processing. This reentrancy breaks the original invariant. The class's qlen remains zero at the point of the second entry, so the code re-adds the same list node to active_list, producing a corrupted doubly linked list with duplicate entries. Subsequent traversal or removal operations on the list dereference stale or aliased pointers.

Root Cause

The root cause is missing state validation in the ETS enqueue path. The pre-patch code checked only whether qlen was zero before calling list_add_tail on the class node. It did not verify whether the class was already present on active_list. The fix introduces a cl_is_active check so the class is added only once, even under reentrant enqueue conditions triggered by netem.

Attack Vector

Exploitation requires local access with the CAP_NET_ADMIN capability or equivalent privileges within a user namespace that permits qdisc configuration. An attacker constructs a traffic control hierarchy pairing sch_ets as the parent with sch_netem as a child qdisc, then generates traffic that induces the reentrant enqueue path. The resulting duplicate list membership corrupts kernel memory structures, enabling denial of service or, with additional exploitation primitives, kernel-level code execution.

A proof-of-concept example is not published. See the upstream discussion thread referenced in the commit message for background on the reentrant enqueue behavior.

Detection Methods for CVE-2025-37914

Indicators of Compromise

Kernel oops or panic messages referencing sch_ets, ets_qdisc_enqueue, or list_add corruption warnings such as list_add corruption. next->prev should be prev.
Unexpected tc qdisc configurations combining ets parents with netem children on production systems.
Repeated soft lockups or scheduler-related kernel warnings in dmesg originating from the networking subsystem.

Detection Strategies

Audit loaded kernel modules for sch_ets and sch_netem on systems that do not require traffic shaping.
Monitor invocation of the tc command with qdisc add arguments referencing ets and netem, particularly by non-root users operating in namespaces with CAP_NET_ADMIN.
Correlate kernel warning messages (WARN_ON, list debug output) with the sch_ets code path in centralized log analysis.

Monitoring Recommendations

Ingest kernel logs (/var/log/kern.log, journald) into a centralized analytics platform and alert on list corruption warnings.
Track process execution telemetry for tc and ip commands with unusual qdisc topologies.
Baseline network namespace creation events and privilege capability grants to detect anomalous use of CAP_NET_ADMIN.

How to Mitigate CVE-2025-37914

Immediate Actions Required

Apply the upstream kernel patches to all affected systems and reboot into the fixed kernel.
Restrict CAP_NET_ADMIN and user namespace creation for untrusted users to prevent qdisc manipulation.
Inventory systems running affected kernel versions and prioritize patching for multi-tenant hosts and container platforms.

Patch Information

The Linux kernel maintainers released fixes across multiple stable branches. Relevant commits include 1a6d0c00, 1f01e9f9, 24388ba0, 554acc5a, 72c3da7e, 9efb6a0f, and bc321f71. Debian users should apply updates from the Debian LTS August 2025 announcement and the Debian LTS October 2025 announcement.

Workarounds

Blacklist the sch_ets and sch_netem kernel modules on systems that do not require them.
Disable unprivileged user namespaces via sysctl kernel.unprivileged_userns_clone=0 where operationally acceptable.
Remove CAP_NET_ADMIN from container profiles and seccomp policies that do not require network configuration.

bash

# Configuration example: prevent module loading and restrict namespaces
echo 'install sch_ets /bin/true' | sudo tee /etc/modprobe.d/blacklist-sch_ets.conf
echo 'install sch_netem /bin/true' | sudo tee /etc/modprobe.d/blacklist-sch_netem.conf
sudo sysctl -w kernel.unprivileged_userns_clone=0