net_sched: ets: Fix double list add in class with netem as child qdisc
CVE: CVE-2025-37914
Component: kernel
CWE: CWE-123
Severity: Moderate
CVSS v3: 7.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2025-05-20T00:00:00+00:00

A use-after-free vulnerability was found in the Linux kernel’s `netem` qdisc. This issue occurs when it incorrectly manages duplicated packets in classful parent qdiscs. This leads to a corrupted internal state and eventual dereferencing of freed memory, resulting in unpredictable behavior, system instability, or a crash.

Statement: A logic flaw in the ETS (Enhanced Transmission Selection) scheduler in the Linux kernel’s net/sched subsystem allows the same class to be added twice to the active list if the enqueue callback is reentered, for example due to a netem child.

Although no UAF occurs, this leads to list corruption, which may result in kernel memory corruption, undefined behavior, or system crashes.

Triggering this bug requires a crafted qdisc hierarchy and interaction between ETS and netem.

An attacker could create memory corruption via list pointers, but turning this into privilege escalation would require further primitives or info leaks.

Likely exploitable for denial-of-service (DoS) in most practical scenarios.

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
If ETS (Enhanced Transmission Selection) scheduler not being used, then the mitigation would be to disabled related Kernel module.
To mitigate this issue, prevent module sch_ets from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.
sch_ets