CVE-2025-21971

net_sched: Prevent creation of classes with TC_H_ROOT

Description

In the Linux kernel, the following vulnerability has been resolved: net_sched: Prevent creation of classes with TC_H_ROOT The function qdisc_tree_reduce_backlog() uses TC_H_ROOT as a termination condition when traversing up the qdisc tree to update parent backlog counters. However, if a class is created with classid TC_H_ROOT, the traversal terminates prematurely at this class instead of reaching the actual root qdisc, causing parent statistics to be incorrectly maintained. In case of DRR, this could lead to a crash as reported by Mingi Cho. Prevent the creation of any Qdisc class with classid TC_H_ROOT (0xFFFFFFFF) across all qdisc types, as suggested by Jamal.

N/A

CVSS

Severity:

EPSS 0.05%

Affected: Linux Linux

References

Link	Tags
https://git.kernel.org/stable/c/e05d9938b1b0ac40b6054cc5fa0ccbd9afd5ed4c
https://git.kernel.org/stable/c/7a82fe67a9f4d7123d8e5ba8f0f0806c28695006
https://git.kernel.org/stable/c/003d92c91cdb5a64b25a9a74cb8543aac9a8bb48
https://git.kernel.org/stable/c/e5ee00607bbfc97ef1526ea95b6b2458ac9e7cb7
https://git.kernel.org/stable/c/78533c4a29ac3aeddce4b481770beaaa4f3bfb67
https://git.kernel.org/stable/c/5c3ca9cb48b51bd72bf76b8b05e24f3cd53db5e7
https://git.kernel.org/stable/c/94edfdfb9505ab608e86599d1d1e38c83816fc1c
https://git.kernel.org/stable/c/0c3057a5a04d07120b3d0ec9c79568fceb9c921e

Frequently Asked Questions

What is the severity of CVE-2025-21971?: CVE-2025-21971 has not yet been assigned a CVSS score.
How to fix CVE-2025-21971?: To fix CVE-2025-21971, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2025-21971 being actively exploited in the wild?: As for now, there are no information to confirm that CVE-2025-21971 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2025-21971?: CVE-2025-21971 affects Linux Linux, Linux Linux.

This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.