---
id: CVE-2025-21971
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  net_sched: Prevent creation of classes with TC_H_ROOT

  The function qdisc_tree_reduce_backlog() uses TC_H_ROOT as a termination
  condition when traversing up the qdisc t…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  net_sched: Prevent creation of classes with TC_H_ROOT

  The function qdisc_tree_reduce_backlog() uses TC_H_ROOT as a termination
  condition when traversing up the qdisc t…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-835
vendor: linux
product: linux_kernel
affected:
  - 'linux_kernel >= 2.6.26, < 5.4.292'
  - 'linux_kernel >= 5.5, < 5.10.236'
  - 'linux_kernel >= 5.11, < 5.15.180'
  - 'linux_kernel >= 5.16, < 6.1.132'
  - 'linux_kernel >= 6.2, < 6.6.84'
  - 'linux_kernel >= 6.7, < 6.12.20'
  - 'linux_kernel >= 6.13, < 6.13.8'
  - linux_kernel = 2.6.25
  - linux_kernel = 6.14
patched:
  - linux_kernel 6.13.8
published: '2025-04-01'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T22:18:12.710'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-21971'
references:
  - url: 'https://git.kernel.org/stable/c/003d92c91cdb5a64b25a9a74cb8543aac9a8bb48'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/0c3057a5a04d07120b3d0ec9c79568fceb9c921e'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/5c3ca9cb48b51bd72bf76b8b05e24f3cd53db5e7'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/78533c4a29ac3aeddce4b481770beaaa4f3bfb67'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/7a82fe67a9f4d7123d8e5ba8f0f0806c28695006'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/94edfdfb9505ab608e86599d1d1e38c83816fc1c'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/e05d9938b1b0ac40b6054cc5fa0ccbd9afd5ed4c'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/e5ee00607bbfc97ef1526ea95b6b2458ac9e7cb7'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html'
    label: af854a3a-2127-422b-91ae-364da2661108
tags:
  - nvd
  - cve.org
epss: 0.00227
epssPercentile: 0.13422
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-15T21:43:55.303520Z'
ingestedAt: '2026-10-15T22:48:25.470Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

net_sched: Prevent creation of classes with TC_H_ROOT

The function qdisc_tree_reduce_backlog() uses TC_H_ROOT as a termination
condition when traversing up the qdisc tree to update parent backlog
counters. However, if a class is created with classid TC_H_ROOT, the
traversal terminates prematurely at this class instead of reaching the
actual root qdisc, causing parent statistics to be incorrectly maintained.
In case of DRR, this could lead to a crash as reported by Mingi Cho.

Prevent the creation of any Qdisc class with classid TC_H_ROOT
(0xFFFFFFFF) across all qdisc types, as suggested by Jamal.

## Affected

- `linux_kernel >= 2.6.26, < 5.4.292`
- `linux_kernel >= 5.5, < 5.10.236`
- `linux_kernel >= 5.11, < 5.15.180`
- `linux_kernel >= 5.16, < 6.1.132`
- `linux_kernel >= 6.2, < 6.6.84`
- `linux_kernel >= 6.7, < 6.12.20`
- `linux_kernel >= 6.13, < 6.13.8`
- `linux_kernel = 2.6.25`
- `linux_kernel = 6.14`

## Remediation

Upgrade past the affected range:

- `linux_kernel 6.13.8`