CVE-2025-21971

Summary

In the Linux kernel, the following vulnerability has been resolved:

net_sched: Prevent creation of classes with TC_H_ROOT

The function qdisc_tree_reduce_backlog() uses TC_H_ROOT as a termination condition when traversing up the qdisc tree to update parent backlog counters. However, if a class is created with classid TC_H_ROOT, the traversal terminates prematurely at this class instead of reaching the actual root qdisc, causing parent statistics to be incorrectly maintained. In case of DRR, this could lead to a crash as reported by Mingi Cho.

Prevent the creation of any Qdisc class with classid TC_H_ROOT (0xFFFFFFFF) across all qdisc types, as suggested by Jamal.

Affected Software

VendorProductVersion RangeStatus
LinuxLinux066a3b5b2346febf9a655b444567b7138e3bb939 < e05d9938b1b0ac40b6054cc5fa0ccbd9afd5ed4caffected
LinuxLinux066a3b5b2346febf9a655b444567b7138e3bb939 < 7a82fe67a9f4d7123d8e5ba8f0f0806c28695006affected
LinuxLinux066a3b5b2346febf9a655b444567b7138e3bb939 < 003d92c91cdb5a64b25a9a74cb8543aac9a8bb48affected
LinuxLinux066a3b5b2346febf9a655b444567b7138e3bb939 < e5ee00607bbfc97ef1526ea95b6b2458ac9e7cb7affected
LinuxLinux066a3b5b2346febf9a655b444567b7138e3bb939 < 78533c4a29ac3aeddce4b481770beaaa4f3bfb67affected
LinuxLinux066a3b5b2346febf9a655b444567b7138e3bb939 < 5c3ca9cb48b51bd72bf76b8b05e24f3cd53db5e7affected
LinuxLinux066a3b5b2346febf9a655b444567b7138e3bb939 < 94edfdfb9505ab608e86599d1d1e38c83816fc1caffected
LinuxLinux066a3b5b2346febf9a655b444567b7138e3bb939 < 0c3057a5a04d07120b3d0ec9c79568fceb9c921eaffected
LinuxLinux2.6.25affected
LinuxLinux0 < 2.6.25unaffected
LinuxLinux5.4.292 <= 5.4.*unaffected
LinuxLinux5.10.236 <= 5.10.*unaffected
LinuxLinux5.15.180 <= 5.15.*unaffected
LinuxLinux6.1.132 <= 6.1.*unaffected
LinuxLinux6.6.84 <= 6.6.*unaffected
LinuxLinux6.12.20 <= 6.12.*unaffected
LinuxLinux6.13.8 <= 6.13.*unaffected
LinuxLinux6.14 <= *unaffected

Weaknesses

ADP Enrichment

CVE Program Container

Additional References

References