CVE-2025-21971: Linux Kernel DOS Vulnerability

CVE-2025-21971 Overview

A vulnerability has been identified in the Linux kernel's network scheduler (net_sched) subsystem that allows the creation of Qdisc classes with the reserved TC_H_ROOT classid (0xFFFFFFFF). The function qdisc_tree_reduce_backlog() uses TC_H_ROOT as a termination condition when traversing up the qdisc tree to update parent backlog counters. When a class is created with classid TC_H_ROOT, the traversal terminates prematurely at this class instead of reaching the actual root qdisc, causing parent statistics to be incorrectly maintained. In the case of DRR (Deficit Round Robin) scheduler, this can lead to a kernel crash.

Critical Impact

Local attackers with privileges to configure network traffic control can trigger an infinite loop condition, causing a system crash or denial of service on affected Linux systems.

Affected Products

• Linux Kernel versions from 2.6.25 through multiple stable branches
• Linux Kernel 6.14-rc1 through 6.14-rc6
• Various Linux distributions using vulnerable kernel versions

Discovery Timeline

• April 1, 2025 - CVE-2025-21971 published to NVD
• November 3, 2025 - Last updated in NVD database

Technical Details for CVE-2025-21971

Vulnerability Analysis

This vulnerability exists in the Linux kernel's traffic control (TC) framework, specifically within the network scheduler subsystem. The qdisc_tree_reduce_backlog() function is responsible for traversing the qdisc hierarchy to update backlog counters when packets are dequeued or dropped. The function uses TC_H_ROOT (defined as 0xFFFFFFFF) as a sentinel value to determine when it has reached the top of the qdisc tree.

The flaw occurs because there is no validation preventing the creation of qdisc classes with the TC_H_ROOT classid. When such a class exists in the hierarchy, the backlog traversal logic encounters this classid and incorrectly interprets it as having reached the root, terminating the upward traversal prematurely. This results in incorrect maintenance of parent statistics and, in certain schedulers like DRR, can trigger an infinite loop or crash condition as reported by researcher Mingi Cho.

Root Cause

The root cause is a missing input validation check in the qdisc class creation path. The kernel should reject any attempt to create a class with the reserved TC_H_ROOT classid (0xFFFFFFFF), as this value is used internally as a termination sentinel in tree traversal algorithms. Without this validation, user-space tools like tc can create classes that corrupt the internal tree traversal logic.

Attack Vector

This vulnerability requires local access to the system with sufficient privileges to configure network traffic control rules. An attacker with CAP_NET_ADMIN capability or root privileges can exploit this vulnerability by:

1. Using the tc command-line utility or netlink sockets to interact with the traffic control subsystem
2. Creating a qdisc class with the classid set to TC_H_ROOT (0xFFFFFFFF)
3. Triggering backlog updates through normal network traffic processing
4. Causing the kernel to enter an infinite loop or crash due to corrupted tree traversal

The vulnerability is particularly dangerous in containerized environments where network namespaces may grant CAP_NET_ADMIN to unprivileged processes.

Detection Methods for CVE-2025-21971

Indicators of Compromise

• Unexpected kernel panics or system crashes related to the net_sched subsystem
• High CPU utilization in kernel context without corresponding user-space activity
• System hangs occurring during network traffic processing
• Kernel log messages referencing qdisc_tree_reduce_backlog or DRR scheduler issues

Detection Strategies

• Monitor for traffic control configuration changes using auditd rules on netlink socket operations
• Implement kernel log monitoring for net_sched-related crash dumps or warnings
• Track tc command executions that specify unusual classid values, particularly 0xFFFFFFFF
• Deploy SentinelOne agents to detect anomalous kernel behavior patterns associated with DoS attempts

Monitoring Recommendations

• Enable kernel crash dump collection to capture forensic evidence if exploitation occurs
• Configure syslog forwarding for kernel messages related to network scheduler subsystems
• Implement real-time alerting on system resource anomalies that could indicate DoS attacks
• Review network namespace configurations in containerized environments for excessive capabilities

How to Mitigate CVE-2025-21971

Immediate Actions Required

• Update the Linux kernel to a patched version from the official stable branches
• Restrict CAP_NET_ADMIN capability to only trusted processes and users
• Review container security policies to limit network namespace capabilities
• Implement additional monitoring for traffic control configuration changes

Patch Information

The Linux kernel maintainers have released patches across multiple stable branches. The fix prevents the creation of any qdisc class with classid TC_H_ROOT (0xFFFFFFFF) across all qdisc types. Organizations should apply the appropriate patch based on their kernel version:

• Kernel Git Commit 003d92c91cdb
• Kernel Git Commit 0c3057a5a04d
• Kernel Git Commit 5c3ca9cb48b5
• Kernel Git Commit 78533c4a29ac
• Kernel Git Commit 7a82fe67a9f4
• Kernel Git Commit 94edfdfb9505
• Kernel Git Commit e05d9938b1b0
• Kernel Git Commit e5ee00607bbf

Debian users should consult the Debian LTS Security Advisory for distribution-specific updates.

Workarounds

• Restrict access to the tc command and netlink sockets using mandatory access control (SELinux/AppArmor)
• Remove CAP_NET_ADMIN from container runtime configurations where not strictly required
• Implement network namespace isolation policies to limit exposure in multi-tenant environments
• Deploy network security monitoring to detect unusual traffic control configuration attempts

# Restrict tc command execution using file permissions
chmod 750 /sbin/tc
chown root:network /sbin/tc

# Add auditd rule to monitor traffic control operations
auditctl -a always,exit -F arch=b64 -S socket -F a0=16 -k netlink_monitor