{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2025-68815 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2025-68815 is a high-severity use after free vulnerability in Linux, published on 13 Jan 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2025-68815 and fix it if it is affected.\n\nWhat it is: CVE-2025-68815 is a high-severity use after free vulnerability in Linux, published on 13 Jan 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2025-68815 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2025-68815/ (Markdown: https://insights.sbomify.com/CVE-2025-68815/index.md)","id":"CVE-2025-68815","markdown":"https://insights.sbomify.com/CVE-2025-68815/index.md","name":"CVE-2025-68815","record":{"aliases":["AZL-74426","BELL-CVE-2025-68815","DEBIAN-CVE-2025-68815","GHSA-46xw-4v36-6pr8","ROOT-OS-DEBIAN-11-CVE-2025-68815","ROOT-OS-DEBIAN-12-CVE-2025-68815","ROOT-OS-DEBIAN-13-CVE-2025-68815","ROOT-OS-UBUNTU-2204-CVE-2025-68815","ROOT-OS-UBUNTU-2404-CVE-2025-68815","UBUNTU-CVE-2025-68815"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["denial_of_service"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel","requires_auth":"low_privilege","summary":"A use-after-free vulnerability in the Linux kernel's ETS qdisc allows local attackers to trigger a double-add list corruption, leading to a system crash.","user_interaction":"not_required","vuln_class":"use_after_free"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":7.8,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"cwes":[{"id":"CWE-416","name":"Use After Free"}],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: ets: Remove drr class from the active list if it changes to strict\n\nWhenever a user issues an ets qdisc change command, transforming a\ndrr class into a strict one, the ets code isn't checking whether that\nclass was in the active list and removing it. This means that, if a\nuser changes a strict class (which was in the active list) back to a drr\none, that class will be added twice to the active list [1].\n\nDoing so with the following commands:\n\ntc qdisc add dev lo root handle 1: ets bands 2 strict 1\ntc qdisc add dev lo parent 1:2 handle 20: \\\n    tbf rate 8bit burst 100b latency 1s\ntc filter add dev lo parent 1: basic classid 1:2\nping -c1 -W0.01 -s 56 127.0.0.1\ntc qdisc change dev lo root handle 1: ets bands 2 strict 2\ntc qdisc change dev lo root handle 1: ets bands 2 strict 1\nping -c1 -W0.01 -s 56 127.0.0.1\n\nWill trigger the following splat with list debug turned on:\n\n[   59.279014][  T365] ------------[ cut here ]------------\n[   59.279452][  T365] list_add double add: new=ffff88801d60e350, prev=ffff88801d60e350, next=ffff88801d60e2c0.\n[   59.280153][  T365] WARNING: CPU: 3 PID: 365 at lib/list_debug.c:35 __list_add_valid_or_report+0x17f/0x220\n[   59.280860][  T365] Modules linked in:\n[   59.281165][  T365] CPU: 3 UID: 0 PID: 365 Comm: tc Not tainted 6.18.0-rc7-00105-g7e9f13163c13-dirty #239 PREEMPT(voluntary)\n[   59.281977][  T365] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011\n[   59.282391][  T365] RIP: 0010:__list_add_valid_or_report+0x17f/0x220\n[   59.282842][  T365] Code: 89 c6 e8 d4 b7 0d ff 90 0f 0b 90 90 31 c0 e9 31 ff ff ff 90 48 c7 c7 e0 a0 22 9f 48 89 f2 48 89 c1 4c 89 c6 e8 b2 b7 0d ff 90 \u003c0f\u003e 0b 90 90 31 c0 e9 0f ff ff ff 48 89 f7 48 89 44 24 10 4c 89 44\n...\n[   59.288812][  T365] Call Trace:\n[   59.289056][  T365]  \u003cTASK\u003e\n[   59.289224][  T365]  ? srso_alias_return_thunk+0x5/0xfbef5\n[   59.289546][  T365]  ets_qdisc_change+0xd2b/0x1e80\n[   59.289891][  T365]  ? __lock_acquire+0x7e7/0x1be0\n[   59.290223][  T365]  ? __pfx_ets_qdisc_change+0x10/0x10\n[   59.290546][  T365]  ? srso_alias_return_thunk+0x5/0xfbef5\n[   59.290898][  T365]  ? __mutex_trylock_common+0xda/0x240\n[   59.291228][  T365]  ? __pfx___mutex_trylock_common+0x10/0x10\n[   59.291655][  T365]  ? srso_alias_return_thunk+0x5/0xfbef5\n[   59.291993][  T365]  ? srso_alias_return_thunk+0x5/0xfbef5\n[   59.292313][  T365]  ? trace_contention_end+0xc8/0x110\n[   59.292656][  T365]  ? srso_alias_return_thunk+0x5/0xfbef5\n[   59.293022][  T365]  ? srso_alias_return_thunk+0x5/0xfbef5\n[   59.293351][  T365]  tc_modify_qdisc+0x63a/0x1cf0\n\nFix this by always checking and removing an ets class from the active list\nwhen changing it to strict.\n\n[1] https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/tree/net/sched/sch_ets.c?id=ce052b9402e461a9aded599f5b47e76bc727f7de#n663","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"net/sched: ets: Remove drr class from the active list if it changes to strict","id":"CVE-2025-68815","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"use_after_free","year":"2025"},"n_packages":0,"n_references":7,"next":{"headline":"net/mlx5: fw_tracer, Validate format string parameters","id":"CVE-2025-68816"},"packages":[],"prev":{"headline":"io_uring: fix filename leak in __io_openat_prep()","id":"CVE-2025-68814"},"products":["Linux"],"published":"2026-01-13","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"total"},"state":"PUBLISHED","updated":"2026-10-19","vendors":["Linux"]},"summary":"A use-after-free vulnerability in the Linux kernel's ETS qdisc allows local attackers to trigger a double-add list corruption, leading to a system crash.","url":"https://insights.sbomify.com/CVE-2025-68815/"}