Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2025-21971

net_sched: Prevent creation of classes with TC_H_ROOT

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 5.4.292, 5.10.236, 5.15.180, 6.1.132, 6.6.84, and 2 more
None on Exploit-DB, Metasploit or GitHub
  • Exploitation: none
  • Automatable: no
  • Technical impact: total

Summary

In the Linux kernel, the following vulnerability has been resolved: net_sched: Prevent creation of classes with TC_H_ROOT The function qdisc_tree_reduce_backlog() uses TC_H_ROOT as a termination condition when traversing up the qdisc tree to update parent backlog counters. However, if a class is created with classid TC_H_ROOT, the traversal terminates prematurely at this class instead of reaching the actual root qdisc, causing parent statistics to be incorrectly maintained. In case of DRR, this could lead to a crash as reported by Mingi Cho. Prevent the creation of any Qdisc class with classid TC_H_ROOT (0xFFFFFFFF) across all qdisc types, as suggested by Jamal.

Timeline

  1. CVE published
  2. CISA SSVC assessment

    Exploitation: none · Automatable: no · Technical impact: total

  3. Record last updated

Affected versions

  • Linux Linux

    From 066a3b5b2346febf9a655b444567b7138e3bb939 · fixed in e05d9938b1b0ac40b6054cc5fa0ccbd9afd5ed4c; From 066a3b5b2346febf9a655b444567b7138e3bb939 · fixed in 7a82fe67a9f4d7123d8e5ba8f0f0806c28695006; From 066a3b5b2346febf9a655b444567b7138e3bb939 · fixed in 003d92c91cdb5a64b25a9a74cb8543aac9a8bb48; From 066a3b5b2346febf9a655b444567b7138e3bb939 · fixed in e5ee00607bbfc97ef1526ea95b6b2458ac9e7cb7; From 066a3b5b2346febf9a655b444567b7138e3bb939 · fixed in 78533c4a29ac3aeddce4b481770beaaa4f3bfb67; From 066a3b5b2346febf9a655b444567b7138e3bb939 · fixed in 5c3ca9cb48b51bd72bf76b8b05e24f3cd53db5e7; From 066a3b5b2346febf9a655b444567b7138e3bb939 · fixed in 94edfdfb9505ab608e86599d1d1e38c83816fc1c; From 066a3b5b2346febf9a655b444567b7138e3bb939 · fixed in 0c3057a5a04d07120b3d0ec9c79568fceb9c921e

  • Linux Linux

    2.6.25

  • KernelLinux

    From 2.6.25 · fixed in 5.4.292; From 5.5.0 · fixed in 5.10.236; From 5.11.0 · fixed in 5.15.180; From 5.16.0 · fixed in 6.1.132; From 6.2.0 · fixed in 6.6.84; From 6.7.0 · fixed in 6.12.20; From 6.13.0 · fixed in 6.13.8

References 8

git.kernel.org