CVE-2025-21703

netem: Update sch->q.qlen before qdisc_tree_reduce_backlog()

State: Published
Severity: 7.8 High
Published: Feb 18, 2025
Updated: Oct 15, 2026
Reserved: Dec 29, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

netem: Update sch->q.qlen before qdisc_tree_reduce_backlog()

qdisc_tree_reduce_backlog() notifies parent qdisc only if child qdisc becomes empty, therefore we need to reduce the backlog of the child qdisc before calling it. Otherwise it would miss the opportunity to call cops->qlen_notify(), in the case of DRR, it resulted in UAF since DRR uses ->qlen_notify() to maintain its active list.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	CISA-ADP

Weaknesses

CWE-416 Use After Free

Affected Products

Product	Versions
LinuxLinux	83c6ab12f08dcc09d4c5ac86fdb89736b28f1d31 to before e395fec75ac2dbffc99b4bce57b7f1f3c5449f2cAffected 216509dda290f6db92c816dd54b83c1df9da9e76 to before 7f31d74fcc556a9166b1bb20515542de7bb939d1Affected c2047b0e216c8edce227d7c42f99ac2877dad0e4 to before 98a2c685293aae122f688cde11d9334dddc5d207Affected 10df49cfca73dfbbdb6c4150d859f7e8926ae427 to before 7b79ca9a1de6a428d486ff52fb3d602321c08f55Affected 3824c5fad18eeb7abe0c4fc966f29959552dca3e to before 1f8e3f4a4b8b90ad274dfbc66fc7d55cb582f4d5Affected 356078a5c55ec8d2061fcc009fb8599f5b0527f9 to before 6312555249082d6d8cc5321ff725df05482d8b83Affected f8d4bc455047cf3903cd6f85f49978987dbb3027 to before 839ecc583fa00fab785fde1c85a326743657fd32Affected f8d4bc455047cf3903cd6f85f49978987dbb3027 to before 638ba5089324796c2ee49af10427459c2de35f71Affected 5.4.288 to before 5.4.291Affected 5.10.232 to before 5.10.235Affected 5.15.175 to before 5.15.179Affected 6.1.121 to before 6.1.129Affected 6.6.67 to before 6.6.78Affected 6.12.6 to before 6.12.14Affected
LinuxLinux	6.13Affected before 6.13Not affected 5.4.291 through 5.4.Not affected 5.10.235 through 5.10.Not affected 5.15.179 through 5.15.Not affected 6.1.129 through 6.1.Not affected 6.6.78 through 6.6.Not affected 6.12.14 through 6.12.Not affected 6.13.3 through 6.13.*Not affected 6.14 and laterNot affected

Product

Versions

LinuxLinux

83c6ab12f08dcc09d4c5ac86fdb89736b28f1d31 to before e395fec75ac2dbffc99b4bce57b7f1f3c5449f2cAffected
216509dda290f6db92c816dd54b83c1df9da9e76 to before 7f31d74fcc556a9166b1bb20515542de7bb939d1Affected
c2047b0e216c8edce227d7c42f99ac2877dad0e4 to before 98a2c685293aae122f688cde11d9334dddc5d207Affected
10df49cfca73dfbbdb6c4150d859f7e8926ae427 to before 7b79ca9a1de6a428d486ff52fb3d602321c08f55Affected
3824c5fad18eeb7abe0c4fc966f29959552dca3e to before 1f8e3f4a4b8b90ad274dfbc66fc7d55cb582f4d5Affected
356078a5c55ec8d2061fcc009fb8599f5b0527f9 to before 6312555249082d6d8cc5321ff725df05482d8b83Affected
f8d4bc455047cf3903cd6f85f49978987dbb3027 to before 839ecc583fa00fab785fde1c85a326743657fd32Affected
f8d4bc455047cf3903cd6f85f49978987dbb3027 to before 638ba5089324796c2ee49af10427459c2de35f71Affected
5.4.288 to before 5.4.291Affected
5.10.232 to before 5.10.235Affected
5.15.175 to before 5.15.179Affected
6.1.121 to before 6.1.129Affected
6.6.67 to before 6.6.78Affected
6.12.6 to before 6.12.14Affected

LinuxLinux

6.13Affected
before 6.13Not affected
5.4.291 through 5.4.*Not affected
5.10.235 through 5.10.*Not affected
5.15.179 through 5.15.*Not affected
6.1.129 through 6.1.*Not affected
6.6.78 through 6.6.*Not affected
6.12.14 through 6.12.*Not affected
6.13.3 through 6.13.*Not affected
6.14 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.