{"id":"CVE-2025-21971","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet_sched: Prevent creation of classes with TC_H_ROOT\n\nThe function qdisc_tree_reduce_backlog() uses TC_H_ROOT as a termination\ncondition when traversing up the qdisc t…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet_sched: Prevent creation of classes with TC_H_ROOT\n\nThe function qdisc_tree_reduce_backlog() uses TC_H_ROOT as a termination\ncondition when traversing up the qdisc t…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-835"],"vendor":"linux","product":"linux_kernel","affected":["linux_kernel >= 2.6.26, < 5.4.292","linux_kernel >= 5.5, < 5.10.236","linux_kernel >= 5.11, < 5.15.180","linux_kernel >= 5.16, < 6.1.132","linux_kernel >= 6.2, < 6.6.84","linux_kernel >= 6.7, < 6.12.20","linux_kernel >= 6.13, < 6.13.8","linux_kernel = 2.6.25","linux_kernel = 6.14"],"patched":["linux_kernel 6.13.8"],"published":"2025-04-01","updated":"2026-10-15","sourceUpdated":"2026-10-15T22:18:12.710","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-21971","references":[{"url":"https://git.kernel.org/stable/c/003d92c91cdb5a64b25a9a74cb8543aac9a8bb48","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/0c3057a5a04d07120b3d0ec9c79568fceb9c921e","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5c3ca9cb48b51bd72bf76b8b05e24f3cd53db5e7","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/78533c4a29ac3aeddce4b481770beaaa4f3bfb67","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7a82fe67a9f4d7123d8e5ba8f0f0806c28695006","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/94edfdfb9505ab608e86599d1d1e38c83816fc1c","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e05d9938b1b0ac40b6054cc5fa0ccbd9afd5ed4c","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e5ee00607bbfc97ef1526ea95b6b2458ac9e7cb7","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html","label":"af854a3a-2127-422b-91ae-364da2661108"}],"tags":["nvd","cve.org"],"epss":0.00227,"epssPercentile":0.13422,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-15T21:43:55.303520Z"},"ingestedAt":"2026-10-15T22:48:25.470Z","slug":"CVE-2025-21971","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet_sched: Prevent creation of classes with TC_H_ROOT\n\nThe function qdisc_tree_reduce_backlog() uses TC_H_ROOT as a termination\ncondition when traversing up the qdisc tree to update parent backlog\ncounters. However, if a class is created with classid TC_H_ROOT, the\ntraversal terminates prematurely at this class instead of reaching the\nactual root qdisc, causing parent statistics to be incorrectly maintained.\nIn case of DRR, this could lead to a crash as reported by Mingi Cho.\n\nPrevent the creation of any Qdisc class with classid TC_H_ROOT\n(0xFFFFFFFF) across all qdisc types, as suggested by Jamal.\n\n## Affected\n\n- `linux_kernel >= 2.6.26, < 5.4.292`\n- `linux_kernel >= 5.5, < 5.10.236`\n- `linux_kernel >= 5.11, < 5.15.180`\n- `linux_kernel >= 5.16, < 6.1.132`\n- `linux_kernel >= 6.2, < 6.6.84`\n- `linux_kernel >= 6.7, < 6.12.20`\n- `linux_kernel >= 6.13, < 6.13.8`\n- `linux_kernel = 2.6.25`\n- `linux_kernel = 6.14`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `linux_kernel 6.13.8`","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}