Yüksek CVSS 7.8
CVE-2025-37913: Linux Kernel: güvenlik açığı
Açıklama (NVD)
In the Linux kernel, the following vulnerability has been resolved: net_sched: qfq: Fix double list add in class with netem as child qdisc As described in Gerrard's report [1], there are use cases where a netem child qdisc will make the parent qdisc's enqueue callback reentrant. In the case of qfq, there won't be a UAF, but the code will add the same classifier to the list twice, which will cause memory corruption. This patch checks whether the class was already added to the agg->active list (cl_is_active) before doing the addition to cater for the reentrant case. [1] https://lore.kernel.org/netdev/CAHcdcOm+03OD2j6R0=YHKqmy=VgJ8xEOKuP6c7mSgnp-TEJJbw@mail.gmail.com/
Özet bilgiler
- Ürün
- Linux Linux Kernel
- CVSS v3.1
- 7.8
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - EPSS
- %0,24 (yüzdelik 15)
- CWE
- CWE-415
- Yama
- Mevcut
Etkilenen sürümler
| Ürün | Başlangıç | Bitiş | Düzeltildi |
|---|---|---|---|
| linux-linux-kernel | 5.0.1 | — | 5.4.294 |
| linux-linux-kernel | 5.5 | — | 5.10.238 |
| linux-linux-kernel | 5.11 | — | 5.15.182 |
| linux-linux-kernel | 5.16 | — | 6.1.138 |
| linux-linux-kernel | 6.2 | — | 6.6.90 |
| linux-linux-kernel | 6.7 | — | 6.12.28 |
| linux-linux-kernel | 6.13 | — | 6.14.6 |
| linux-linux-kernel | 5.0 | 5.0 | — |
| linux-linux-kernel | 5.0 | 5.0 | — |
| linux-linux-kernel | 5.0 | 5.0 | — |
| linux-linux-kernel | 5.0 | 5.0 | — |
| linux-linux-kernel | 5.0 | 5.0 | — |
| linux-linux-kernel | 5.0 | 5.0 | — |
| linux-linux-kernel | 5.0 | 5.0 | — |
| linux-linux-kernel | 6.15 | 6.15 | — |
| linux-linux-kernel | 6.15 | 6.15 | — |
| linux-linux-kernel | 6.15 | 6.15 | — |
| linux-linux-kernel | 6.15 | 6.15 | — |
| debian-debian-linux | 11.0 | 11.0 | — |