CVE-2025-37915

A flaw was found in the Linux kernel's Deficit Round Robin (DRR) network scheduling subsystem. When the scheduler is configured with a network emulator child queuing discipline, reentrant packet processing can cause an active list entry to be registered twice. A local user could exploit this issue to cause memory corruption, leading to a system crash and Denial of Service (DoS).

A moderate-severity vulnerability affects the Linux kernel's Deficit Round Robin (DRR) network scheduler (net_sched) in the kernel and kernel-rt packages shipped in Red Hat Enterprise Linux 8, and in the Hosted OpenShift offerings (OpenShift Dedicated and Azure Red Hat OpenShift) built on RHEL 8 kernels. When a DRR class is configured with a network emulator (netem) child qdisc, the netem child can make the parent qdisc's enqueue callback reentrant, causing the same class to be added to the active list twice. This double list insertion results in kernel memory corruption that can crash the system, causing a denial of service. Exploitation requires local access with the privileges needed to configure network traffic control; the flaw does not involve a use-after-free and has no confidentiality impact.

Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 10, and Red Hat In-Vehicle OS are not affected because the vulnerable code is not present in those kernels. Red Hat Enterprise Linux 6 and 7 are out of support scope.

The fix for the affected Red Hat Enterprise Linux 8 streams is deferred. The residual risk is limited because an attacker already needs local network-configuration privileges, the attack complexity is high, and the impact is memory corruption leading to a system crash (availability) rather than disclosure of information.

Red Hat rates this flaw as MODERATE (CVSS 6.3, CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H), which differs from the NIST rating of 7.0 and the CVE.org rating of 7.8; Red Hat's scoring reflects the local, privilege-requiring attack path with high attack complexity and no confidentiality impact.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

This flaw is triggered only when a netem qdisc is attached as a child of a DRR class. As a workaround, avoid this configuration: remove or replace netem child qdiscs that are attached under a DRR parent qdisc, since without the netem child the DRR enqueue callback is not reentrant and a class cannot be added to the active list twice. There is no other mitigation available for affected systems at this time; apply kernel updates when a fix is released for the deferred streams.