CVE-2025-21971: Linux Kernel DoS Vulnerability

CVE-2025-21971 Overview

CVE-2025-21971 is a Linux kernel vulnerability in the net_sched traffic control subsystem. The flaw allows local users to crash the kernel by creating a queueing discipline (Qdisc) class with the reserved classid TC_H_ROOT (0xFFFFFFFF). The function qdisc_tree_reduce_backlog() uses TC_H_ROOT as a termination sentinel when walking up the Qdisc tree to update parent backlog counters. A class created with this classid causes premature traversal termination, corrupting parent statistics. In the Deferred Round Robin (DRR) scheduler, this triggers a kernel crash as reported by Mingi Cho. The issue is classified as a loop with unreachable exit condition [CWE-835].

Critical Impact
Local users with CAP_NET_ADMIN in any network namespace can trigger a kernel denial of service through malformed Qdisc class creation, affecting system availability.

Affected Products

Linux kernel versions from 2.6.25 onward containing the vulnerable net_sched code path
Linux kernel 6.14 release candidates (rc1 through rc6)
Debian LTS distributions shipping affected kernel branches

Discovery Timeline

2025-04-01 - CVE-2025-21971 published to NVD
2025-11-03 - Last updated in NVD database

Technical Details for CVE-2025-21971

Vulnerability Analysis

The Linux kernel network scheduler subsystem (net_sched) manages packet queueing and traffic shaping through Qdiscs and their associated classes. The function qdisc_tree_reduce_backlog() traverses upward through the Qdisc hierarchy to decrement parent backlog counters when packets are dropped or dequeued. The traversal relies on TC_H_ROOT (0xFFFFFFFF) as a sentinel value that signals the top of the tree.

The kernel did not validate that user-supplied classids differ from this reserved sentinel. When a class is created with classid TC_H_ROOT, the upward walk terminates at the class itself rather than reaching the actual root Qdisc. Parent statistics become inconsistent, and in the Deferred Round Robin (DRR) scheduler this state divergence triggers a crash.

Root Cause

The root cause is missing input validation in the Qdisc class creation path [CWE-835]. The kernel accepts any 32-bit classid from user space, including the reserved TC_H_ROOT value used internally as a loop terminator. The fix prevents creation of any Qdisc class with classid TC_H_ROOT across all Qdisc types, as suggested by Jamal Hadi Salim during upstream review.

Attack Vector

Exploitation requires local access and the CAP_NET_ADMIN capability, which an unprivileged user can obtain inside a user namespace on default Linux configurations. The attacker invokes the tc userspace tool, or sends crafted Netlink messages directly, to create a class with classid 0xFFFFFFFF under a DRR Qdisc. Subsequent packet processing or backlog accounting against that class dereferences inconsistent state and panics the kernel.

No verified public exploit code is available. The vulnerability mechanism is described in the upstream commit messages referenced in the Linux kernel stable tree.

Detection Methods for CVE-2025-21971

Indicators of Compromise

Unexpected kernel oops or panic messages referencing qdisc_tree_reduce_backlog, drr_enqueue, or drr_dequeue in dmesg or /var/log/kern.log
Audit records showing tc class add or Netlink RTM_NEWTCLASS operations specifying classid ffff:ffff
System crashes correlated with traffic control configuration changes by non-root users in containerized environments

Detection Strategies

Monitor auditd for execve events invoking /sbin/tc with classid 0xFFFFFFFF or ffff:ffff arguments
Inspect Netlink socket activity for RTM_NEWTCLASS messages targeting reserved classids using eBPF tracing
Correlate kernel crash dumps with preceding traffic control modifications via centralized log analysis

Monitoring Recommendations

Enable kernel crash collection (kdump) on systems running unpatched kernels to capture forensic evidence
Track use of CAP_NET_ADMIN inside user namespaces, particularly on container hosts
Alert on repeated kernel oops events affecting sch_drr.ko or related scheduler modules

How to Mitigate CVE-2025-21971

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the stable tree commits listed in vendor advisories
Update to the patched kernel package supplied by your distribution, including the fixes in the Debian LTS announcement
Restrict CAP_NET_ADMIN inside unprivileged user namespaces on multi-tenant or container hosts

Patch Information

The fix is distributed across multiple stable branches via commits including e5ee00607bbf, 94edfdfb9505, and 003d92c91cdb. The patches reject any Qdisc class creation request where the classid equals TC_H_ROOT. Debian users should consult the Debian LTS advisory for backported package versions.

Workarounds

Disable the DRR scheduler module by blacklisting sch_drr if the scheduler is not required for workload traffic shaping
Set kernel.unprivileged_userns_clone=0 (or the equivalent user.max_user_namespaces=0) to prevent unprivileged user namespace creation
Apply seccomp or SELinux policies that block the tc binary and Netlink NETLINK_ROUTE operations for untrusted users

bash

# Configuration example
# Block unprivileged user namespaces (Debian/Ubuntu)
sudo sysctl -w kernel.unprivileged_userns_clone=0
echo 'kernel.unprivileged_userns_clone=0' | sudo tee /etc/sysctl.d/99-cve-2025-21971.conf

# Blacklist the DRR scheduler module if unused
echo 'blacklist sch_drr' | sudo tee /etc/modprobe.d/blacklist-sch_drr.conf
sudo update-initramfs -u