CVE-2025-37914

A use-after-free vulnerability was found in the Linux kernel’s netem qdisc. This issue occurs when it incorrectly manages duplicated packets in classful parent qdiscs. This leads to a corrupted internal state and eventual dereferencing of freed memory, resulting in unpredictable behavior, system instability, or a crash.

A logic flaw in the ETS (Enhanced Transmission Selection) scheduler in the Linux kernel’s net/sched subsystem allows the same class to be added twice to the active list if the enqueue callback is reentered, for example due to a netem child.

Although no UAF occurs, this leads to list corruption, which may result in kernel memory corruption, undefined behavior, or system crashes.

Triggering this bug requires a crafted qdisc hierarchy and interaction between ETS and netem.

An attacker could create memory corruption via list pointers, but turning this into privilege escalation would require further primitives or info leaks.

Likely exploitable for denial-of-service (DoS) in most practical scenarios.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

If ETS (Enhanced Transmission Selection) scheduler not being used, then the mitigation would be to disabled related Kernel module. To mitigate this issue, prevent module sch_ets from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically. sch_ets