Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC PR UI S C I A CVSS EPSS %ile KEV L H L N U H H H 7.0 .0018 8.3 —
AFFECTED Product Versions Fixed Linux 37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea – — Linux 5.0 – 5.4.294
TIMELINE Apr 16 Reserved by Linux May 20 Published (CNA: Linux) Jul 30 RESCORED — CVE-2025-37915 (Linux). CVSS 7.8 → 7 (NVD).
In the Linux kernel, the following vulnerability has been resolved: net_sched: drr: Fix double list add in class with netem as child qdisc As described in Gerrard's report [1], there are use cases where a netem child qdisc will make the parent qdisc's enqueue callback reentrant. In the case of drr, there won't be a UAF, but the code will add the same classifier to the list twice, which will cause memory corruption. In addition to checking for qlen being zero, this patch checks whether the class was already added to the active_list (cl_is_active) before adding to the list to cover for the reentrant case. [1] https://lore.kernel.org/netdev/CAHcdcOm+03OD2j6R0=YHKqmy=VgJ8xEOKuP6c7mSgnp-TEJJbw@mail.gmail.com/
| Date | Event | Detail |
|---|---|---|
| April 16, 2025 | Reserved | Reserved by Linux |
| May 20, 2025 | Published | Published (CNA: Linux) |
| July 30, 2026 | RESCORED | RESCORED — CVE-2025-37915 (Linux). CVSS 7.8 → 7 (NVD). |
Authoritative record: CVE-2025-37915 at cve.org
Vendors: linux
Weaknesses: CWE-415
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2025-37915 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.