In the Linux kernel, the following vulnerability has been resolved:
net_sched: drr: Fix double list add in class with netem as child qdisc
As described in Gerrard's report [1], there are use cases where a netem child qdisc will make the parent qdisc's enqueue callback reentrant. In the case of drr, there won't be a UAF, but the code will add the same classifier to the list twice, which will cause memory corruption.
In addition to checking for qlen being zero, this patch checks whether the class was already added to the activelist (clis_active) before adding to the list to cover for the reentrant case.
[1] https://lore.kernel.org/netdev/CAHcdcOm+03OD2j6R0=YHKqmy=VgJ8xEOKuP6c7mSgnp-TEJJbw@mail.gmail.com/
[
    {
        "signature_version": "v1",
        "id": "CVE-2025-37915-05f7e363",
        "signature_type": "Function",
        "digest": {
            "length": 750.0,
            "function_hash": "60709430041823504009247440804804429648"
        },
        "target": {
            "file": "net/sched/sch_drr.c",
            "function": "drr_enqueue"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2968632880f1792007eedd12eeedf7f6e2b7e9f3",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "id": "CVE-2025-37915-4d5f2be2",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "309886434291598296112681787637807640666",
                "9484678611272442454671755514319903190",
                "303517904055283449667416161258777406085",
                "134137468619647411359994737352846186577",
                "333270966136870770297241474018708047390",
                "288353569412007181421615649624646386435",
                "311592408522973054385908598848474142864",
                "140974099743271624036611059627572982197",
                "252558819941388581288706271153214883799",
                "243188693581562688663333988066934983016",
                "92489964873688335771792690573631218899",
                "1944425881276499845167178436236543885",
                "85617774060329366336251093241597234143",
                "217431605280841960665263674089965287047",
                "182811558769732534824844811760964640104"
            ]
        },
        "target": {
            "file": "net/sched/sch_drr.c"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4b07ac06b0a712923255aaf2691637693fc7100d",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "id": "CVE-2025-37915-6a608b2c",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "309886434291598296112681787637807640666",
                "9484678611272442454671755514319903190",
                "303517904055283449667416161258777406085",
                "134137468619647411359994737352846186577",
                "333270966136870770297241474018708047390",
                "288353569412007181421615649624646386435",
                "311592408522973054385908598848474142864",
                "140974099743271624036611059627572982197",
                "252558819941388581288706271153214883799",
                "243188693581562688663333988066934983016",
                "92489964873688335771792690573631218899",
                "1944425881276499845167178436236543885",
                "85617774060329366336251093241597234143",
                "217431605280841960665263674089965287047",
                "182811558769732534824844811760964640104"
            ]
        },
        "target": {
            "file": "net/sched/sch_drr.c"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4f0ecf50cdf76da95828578a92f130b653ac2fcf",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "id": "CVE-2025-37915-87de7ebf",
        "signature_type": "Function",
        "digest": {
            "length": 750.0,
            "function_hash": "60709430041823504009247440804804429648"
        },
        "target": {
            "file": "net/sched/sch_drr.c",
            "function": "drr_enqueue"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ab2248110738d4429668140ad22f530a9ee730e1",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "id": "CVE-2025-37915-88900863",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "309886434291598296112681787637807640666",
                "9484678611272442454671755514319903190",
                "303517904055283449667416161258777406085",
                "134137468619647411359994737352846186577",
                "333270966136870770297241474018708047390",
                "288353569412007181421615649624646386435",
                "311592408522973054385908598848474142864",
                "140974099743271624036611059627572982197",
                "252558819941388581288706271153214883799",
                "243188693581562688663333988066934983016",
                "92489964873688335771792690573631218899",
                "1944425881276499845167178436236543885",
                "85617774060329366336251093241597234143",
                "217431605280841960665263674089965287047",
                "182811558769732534824844811760964640104"
            ]
        },
        "target": {
            "file": "net/sched/sch_drr.c"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2968632880f1792007eedd12eeedf7f6e2b7e9f3",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "id": "CVE-2025-37915-8d30e164",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "309886434291598296112681787637807640666",
                "9484678611272442454671755514319903190",
                "303517904055283449667416161258777406085",
                "134137468619647411359994737352846186577",
                "333270966136870770297241474018708047390",
                "288353569412007181421615649624646386435",
                "311592408522973054385908598848474142864",
                "140974099743271624036611059627572982197",
                "252558819941388581288706271153214883799",
                "243188693581562688663333988066934983016",
                "92489964873688335771792690573631218899",
                "1944425881276499845167178436236543885",
                "85617774060329366336251093241597234143",
                "217431605280841960665263674089965287047",
                "182811558769732534824844811760964640104"
            ]
        },
        "target": {
            "file": "net/sched/sch_drr.c"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@26e75716b94d6ff9be5ea07d63675c4d189f30b4",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "id": "CVE-2025-37915-907d78e7",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "309886434291598296112681787637807640666",
                "9484678611272442454671755514319903190",
                "303517904055283449667416161258777406085",
                "134137468619647411359994737352846186577",
                "333270966136870770297241474018708047390",
                "288353569412007181421615649624646386435",
                "311592408522973054385908598848474142864",
                "140974099743271624036611059627572982197",
                "252558819941388581288706271153214883799",
                "243188693581562688663333988066934983016",
                "92489964873688335771792690573631218899",
                "1944425881276499845167178436236543885",
                "85617774060329366336251093241597234143",
                "217431605280841960665263674089965287047",
                "182811558769732534824844811760964640104"
            ]
        },
        "target": {
            "file": "net/sched/sch_drr.c"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ab2248110738d4429668140ad22f530a9ee730e1",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "id": "CVE-2025-37915-9c437ccf",
        "signature_type": "Function",
        "digest": {
            "length": 750.0,
            "function_hash": "60709430041823504009247440804804429648"
        },
        "target": {
            "file": "net/sched/sch_drr.c",
            "function": "drr_enqueue"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4b07ac06b0a712923255aaf2691637693fc7100d",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "id": "CVE-2025-37915-a4503d6e",
        "signature_type": "Function",
        "digest": {
            "length": 750.0,
            "function_hash": "60709430041823504009247440804804429648"
        },
        "target": {
            "file": "net/sched/sch_drr.c",
            "function": "drr_enqueue"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@26e75716b94d6ff9be5ea07d63675c4d189f30b4",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "id": "CVE-2025-37915-cae16eae",
        "signature_type": "Function",
        "digest": {
            "length": 750.0,
            "function_hash": "60709430041823504009247440804804429648"
        },
        "target": {
            "file": "net/sched/sch_drr.c",
            "function": "drr_enqueue"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4f0ecf50cdf76da95828578a92f130b653ac2fcf",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "id": "CVE-2025-37915-d8c70d8a",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "309886434291598296112681787637807640666",
                "9484678611272442454671755514319903190",
                "303517904055283449667416161258777406085",
                "134137468619647411359994737352846186577",
                "333270966136870770297241474018708047390",
                "288353569412007181421615649624646386435",
                "311592408522973054385908598848474142864",
                "140974099743271624036611059627572982197",
                "252558819941388581288706271153214883799",
                "243188693581562688663333988066934983016",
                "92489964873688335771792690573631218899",
                "1944425881276499845167178436236543885",
                "85617774060329366336251093241597234143",
                "217431605280841960665263674089965287047",
                "182811558769732534824844811760964640104"
            ]
        },
        "target": {
            "file": "net/sched/sch_drr.c"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f99a3fbf023e20b626be4b0f042463d598050c9a",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "id": "CVE-2025-37915-ea0d82ef",
        "signature_type": "Function",
        "digest": {
            "length": 750.0,
            "function_hash": "60709430041823504009247440804804429648"
        },
        "target": {
            "file": "net/sched/sch_drr.c",
            "function": "drr_enqueue"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f99a3fbf023e20b626be4b0f042463d598050c9a",
        "deprecated": false
    }
]