Use-after-free in Linux kernel sched

1) Use-after-free

EUVDB-ID: #VU109504

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-37915

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the cl_is_active() and drr_enqueue() functions in net/sched/sch_drr.c. A local user can escalate privileges on the system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Linux kernel: 5.15 - 6.14.5

CPE2.3

• cpe:2.3:o:linux_foundation:linux_kernel:5.15:*:*:*:*:*:*:*
• cpe:2.3:o:linux_foundation:linux_kernel:5.15:rc1:*:*:*:*:*:*
• cpe:2.3:o:linux_foundation:linux_kernel:5.15:rc2:*:*:*:*:*:*
• cpe:2.3:o:linux_foundation:linux_kernel:5.15:rc3:*:*:*:*:*:*
• cpe:2.3:o:linux_foundation:linux_kernel:5.15:rc4:*:*:*:*:*:*
• cpe:2.3:o:linux_foundation:linux_kernel:5.15:rc5:*:*:*:*:*:*
• cpe:2.3:o:linux_foundation:linux_kernel:5.15:rc6:*:*:*:*:*:*
• cpe:2.3:o:linux_foundation:linux_kernel:5.15:rc7:*:*:*:*:*:*
• cpe:2.3:o:linux_foundation:linux_kernel:5.15.0:*:*:*:*:*:*:*
• cpe:2.3:o:linux_foundation:linux_kernel:5.15.1:*:*:*:*:*:*:*

External links

https://git.kernel.org/stable/c/26e75716b94d6ff9be5ea07d63675c4d189f30b4
https://git.kernel.org/stable/c/2968632880f1792007eedd12eeedf7f6e2b7e9f3
https://git.kernel.org/stable/c/4f0ecf50cdf76da95828578a92f130b653ac2fcf
https://git.kernel.org/stable/c/ab2248110738d4429668140ad22f530a9ee730e1
https://git.kernel.org/stable/c/db205b92dfe0501e5b92fb7cf00971d0e44ba3eb
https://git.kernel.org/stable/c/f99a3fbf023e20b626be4b0f042463d598050c9a
https://mirrors.edge.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.182
https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.138
https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.28
https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.14.6
https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.90

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.