{
  "schemaVersion": 1,
  "attribution": [
    {
      "source": "CISA Known Exploited Vulnerabilities",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "licence": "US government work"
    },
    {
      "source": "GitHub Advisory Database",
      "url": "https://github.com/advisories",
      "licence": "CC BY 4.0"
    },
    {
      "source": "Have I Been Pwned",
      "url": "https://haveibeenpwned.com/",
      "licence": "CC BY 4.0"
    },
    {
      "source": "CVE Program (CVE records)",
      "url": "https://www.cve.org/Legal/TermsOfUse",
      "licence": "CVE Terms of Use",
      "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.",
      "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy."
    },
    {
      "source": "FIRST EPSS",
      "url": "https://www.first.org/epss/",
      "licence": "free to use; FIRST requests attribution"
    }
  ],
  "record": {
    "id": "CVE-2025-37992",
    "sourceURL": "https://www.cve.org/CVERecord?id=CVE-2025-37992",
    "idYear": 2025,
    "status": "PUBLISHED",
    "publishedAt": "2025-05-26T14:54:15.796Z",
    "updatedAt": "2026-05-11T21:19:12.976Z",
    "importedAt": "2026-10-24T01:57:34.152Z",
    "snapshot": {
      "id": "cve_2026-10-24_midnight_baseline",
      "at": "2026-10-24T00:00:00.000Z",
      "source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z"
    },
    "facts": {
      "title": "net_sched: Flush gso_skb list too during ->change()",
      "summary": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet_sched: Flush gso_skb list too during ->change()\n\nPreviously, when reducing a qdisc's limit via the ->change() operation, only\nthe main skb queue was trimmed, potentially leaving packets in the gso_skb\nlist. This could result in NULL pointer dereference when we only check\nsch->limit against sch->q.qlen.\n\nThis patch introduces a new helper, qdisc_dequeue_internal(), which ensures\nboth the gso_skb list and the main queue are properly flushed when trimming\nexcess packets. All relevant qdiscs (codel, fq, fq_codel, fq_pie, hhf, pie)\nare updated to use this helper in their ->change() routines.",
      "affected": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "76e3cc126bb223013a6b9a0e2a51238d1ef2e409",
              "status": "affected",
              "versionType": "git",
              "lessThan": "ea1132ccb112f51ba749c56a912f67970c2cd542"
            },
            {
              "version": "76e3cc126bb223013a6b9a0e2a51238d1ef2e409",
              "status": "affected",
              "versionType": "git",
              "lessThan": "d3336f746f196c6a53e0480923ae93939f047b6c"
            },
            {
              "version": "76e3cc126bb223013a6b9a0e2a51238d1ef2e409",
              "status": "affected",
              "versionType": "git",
              "lessThan": "d38939ebe0d992d581acb6885c1723fa83c1fb2c"
            },
            {
              "version": "76e3cc126bb223013a6b9a0e2a51238d1ef2e409",
              "status": "affected",
              "versionType": "git",
              "lessThan": "a7d6e0ac0a8861f6b1027488062251a8e28150fd"
            },
            {
              "version": "76e3cc126bb223013a6b9a0e2a51238d1ef2e409",
              "status": "affected",
              "versionType": "git",
              "lessThan": "d1365ca80b012d8a7863e45949e413fb61fa4861"
            },
            {
              "version": "76e3cc126bb223013a6b9a0e2a51238d1ef2e409",
              "status": "affected",
              "versionType": "git",
              "lessThan": "fe88c7e4fc2c1cd75a278a15ffbf1689efad4e76"
            },
            {
              "version": "76e3cc126bb223013a6b9a0e2a51238d1ef2e409",
              "status": "affected",
              "versionType": "git",
              "lessThan": "2d3cbfd6d54a2c39ce3244f33f85c595844bd7b8"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "versions": [
            {
              "version": "3.5",
              "status": "affected"
            },
            {
              "version": "0",
              "status": "unaffected",
              "versionType": "semver",
              "lessThan": "3.5"
            },
            {
              "version": "5.10.238",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "version": "5.15.184",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "version": "6.1.140",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "version": "6.6.92",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "version": "6.12.30",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "version": "6.14.8",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.14.*"
            },
            {
              "version": "6.15",
              "status": "unaffected",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ]
        }
      ]
    }
  }
}