CVE-2025-21971

net_sched: Prevent creation of classes with TC_H_ROOT

State: Published
Severity: 7.8 High
Published: Apr 1, 2025
Updated: Oct 15, 2026
Reserved: Dec 29, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

net_sched: Prevent creation of classes with TC_H_ROOT

The function qdisc_tree_reduce_backlog() uses TC_H_ROOT as a termination condition when traversing up the qdisc tree to update parent backlog counters. However, if a class is created with classid TC_H_ROOT, the traversal terminates prematurely at this class instead of reaching the actual root qdisc, causing parent statistics to be incorrectly maintained. In case of DRR, this could lead to a crash as reported by Mingi Cho.

Prevent the creation of any Qdisc class with classid TC_H_ROOT (0xFFFFFFFF) across all qdisc types, as suggested by Jamal.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	066a3b5b2346febf9a655b444567b7138e3bb939 to before e05d9938b1b0ac40b6054cc5fa0ccbd9afd5ed4cAffected 066a3b5b2346febf9a655b444567b7138e3bb939 to before 7a82fe67a9f4d7123d8e5ba8f0f0806c28695006Affected 066a3b5b2346febf9a655b444567b7138e3bb939 to before 003d92c91cdb5a64b25a9a74cb8543aac9a8bb48Affected 066a3b5b2346febf9a655b444567b7138e3bb939 to before e5ee00607bbfc97ef1526ea95b6b2458ac9e7cb7Affected 066a3b5b2346febf9a655b444567b7138e3bb939 to before 78533c4a29ac3aeddce4b481770beaaa4f3bfb67Affected 066a3b5b2346febf9a655b444567b7138e3bb939 to before 5c3ca9cb48b51bd72bf76b8b05e24f3cd53db5e7Affected 066a3b5b2346febf9a655b444567b7138e3bb939 to before 94edfdfb9505ab608e86599d1d1e38c83816fc1cAffected 066a3b5b2346febf9a655b444567b7138e3bb939 to before 0c3057a5a04d07120b3d0ec9c79568fceb9c921eAffected
LinuxLinux	2.6.25Affected before 2.6.25Not affected 5.4.292 through 5.4.Not affected 5.10.236 through 5.10.Not affected 5.15.180 through 5.15.Not affected 6.1.132 through 6.1.Not affected 6.6.84 through 6.6.Not affected 6.12.20 through 6.12.Not affected 6.13.8 through 6.13.*Not affected 6.14 and laterNot affected

Product

Versions

LinuxLinux

066a3b5b2346febf9a655b444567b7138e3bb939 to before e05d9938b1b0ac40b6054cc5fa0ccbd9afd5ed4cAffected
066a3b5b2346febf9a655b444567b7138e3bb939 to before 7a82fe67a9f4d7123d8e5ba8f0f0806c28695006Affected
066a3b5b2346febf9a655b444567b7138e3bb939 to before 003d92c91cdb5a64b25a9a74cb8543aac9a8bb48Affected
066a3b5b2346febf9a655b444567b7138e3bb939 to before e5ee00607bbfc97ef1526ea95b6b2458ac9e7cb7Affected
066a3b5b2346febf9a655b444567b7138e3bb939 to before 78533c4a29ac3aeddce4b481770beaaa4f3bfb67Affected
066a3b5b2346febf9a655b444567b7138e3bb939 to before 5c3ca9cb48b51bd72bf76b8b05e24f3cd53db5e7Affected
066a3b5b2346febf9a655b444567b7138e3bb939 to before 94edfdfb9505ab608e86599d1d1e38c83816fc1cAffected
066a3b5b2346febf9a655b444567b7138e3bb939 to before 0c3057a5a04d07120b3d0ec9c79568fceb9c921eAffected

LinuxLinux

2.6.25Affected
before 2.6.25Not affected
5.4.292 through 5.4.*Not affected
5.10.236 through 5.10.*Not affected
5.15.180 through 5.15.*Not affected
6.1.132 through 6.1.*Not affected
6.6.84 through 6.6.*Not affected
6.12.20 through 6.12.*Not affected
6.13.8 through 6.13.*Not affected
6.14 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.