CVE-2025-68815: Linux Kernel Privilege Escalation Flaw

CVE-2025-68815 Overview

A vulnerability has been identified in the Linux kernel's network scheduler (net/sched) ETS (Enhanced Transmission Selection) qdisc implementation. The flaw exists in the handling of class type changes where a DRR (Deficit Round Robin) class is transformed into a strict priority class. When this transformation occurs, the kernel code fails to properly remove the class from the active list, leading to a condition where the class can be added to the active list twice upon subsequent changes.

Critical Impact

This vulnerability can cause kernel warnings and potential system instability when manipulating ETS qdisc configurations through the tc (traffic control) utility. The double-add to the active list triggers list corruption detection in debug builds.

Affected Products

• Linux Kernel (net/sched ETS qdisc module)
• Systems running kernel version 6.18.0-rc7 and potentially earlier versions
• Linux distributions using affected kernel versions with traffic control functionality

Discovery Timeline

• 2026-01-13 - CVE CVE-2025-68815 published to NVD
• 2026-01-13 - Last updated in NVD database

Technical Details for CVE-2025-68815

Vulnerability Analysis

The vulnerability resides in the ets_qdisc_change() function within the Linux kernel's ETS (Enhanced Transmission Selection) qdisc implementation. ETS is a traffic scheduling algorithm that combines strict priority queuing with DRR (Deficit Round Robin) for bandwidth sharing among classes.

When a user modifies an ETS qdisc configuration using the tc qdisc change command to convert a DRR class to a strict priority class, the code fails to check whether that class was previously in the active list. If the class was active (had packets queued), it remains in the active list even after becoming a strict class. Subsequently, when the configuration is changed back to DRR, the class is added to the active list again, resulting in a double-add condition.

This list corruption is detected by the kernel's list debugging infrastructure, triggering a list_add double add warning. The stack trace shows the corruption occurring within ets_qdisc_change() called from tc_modify_qdisc().

Root Cause

The root cause is an incomplete state management during qdisc class type transitions. The ets_qdisc_change() function modifies the class type (from DRR to strict or vice versa) without properly cleaning up the class's membership in internal data structures. Specifically, when a DRR class that is currently in the active list is converted to a strict class, the code should remove it from the active list to maintain list integrity. The absence of this removal operation leads to list corruption upon subsequent class type changes.

Attack Vector

This vulnerability requires local access with privileges to modify network qdisc configurations (typically root or CAP_NET_ADMIN capability). The attack vector involves:

1. Creating an ETS qdisc with a combination of strict and DRR bands
2. Generating traffic to activate the DRR class (add it to the active list)
3. Changing the qdisc configuration to convert the active DRR class to strict
4. Reverting the configuration back to DRR, triggering the double-add

The exploitation sequence using standard tc commands demonstrates the issue:

• tc qdisc add dev lo root handle 1: ets bands 2 strict 1
• Adding a child qdisc and filter to direct traffic
• Sending traffic to populate the queue
• tc qdisc change dev lo root handle 1: ets bands 2 strict 2 (converts DRR to strict)
• tc qdisc change dev lo root handle 1: ets bands 2 strict 1 (converts back, triggers bug)

Detection Methods for CVE-2025-68815

Indicators of Compromise

• Kernel warning messages containing list_add double add in system logs
• Stack traces referencing ets_qdisc_change() and tc_modify_qdisc() functions
• Unexpected system behavior or instability when modifying ETS qdisc configurations
• Kernel crash dumps showing list corruption in the net/sched subsystem

Detection Strategies

• Monitor kernel logs (dmesg, /var/log/kern.log) for list_add double add warnings
• Enable kernel list debugging (CONFIG_DEBUG_LIST) to catch list corruption early
• Audit usage of tc qdisc change commands targeting ETS qdiscs
• Deploy kernel audit rules to track qdisc modification operations with CAP_NET_ADMIN

Monitoring Recommendations

• Configure syslog alerting for kernel warnings related to list operations
• Implement monitoring for traffic control configuration changes via tc utility
• Enable kernel crash dump collection (kdump) to capture state during failures
• Use SentinelOne's Linux agent to detect anomalous kernel behavior and privilege escalation attempts

How to Mitigate CVE-2025-68815

Immediate Actions Required

• Apply the kernel patches referenced in the security advisories
• Restrict access to traffic control utilities (tc) to only authorized administrators
• Avoid dynamic modification of ETS qdisc class types on production systems until patched
• Consider using alternative qdisc implementations if ETS is not strictly required

Patch Information

The Linux kernel developers have released patches to address this vulnerability. The fix ensures that when an ETS class is changed to strict priority mode, it is properly removed from the active list if it was previously a DRR class. Multiple patch commits are available:

• Linux Kernel Commit Note
• Linux Kernel Commit Change
• Linux Kernel Commit Update
• Linux Kernel Commit Fix
• Linux Kernel Commit Improvement

Organizations should update to kernel versions containing these fixes through their distribution's package manager.

Workarounds

• Implement strict access controls limiting CAP_NET_ADMIN capability to essential personnel only
• Avoid using the ETS qdisc with dynamic class type changes until patches are applied
• Use static qdisc configurations that do not require runtime modification of class types
• Deploy network namespace isolation to limit the impact of qdisc misconfigurations

# Restrict tc binary execution to root only
chmod 700 /sbin/tc

# Audit tc command usage
auditctl -w /sbin/tc -p x -k tc_usage

# Check current kernel version
uname -r

# Verify if ETS qdisc module is loaded
lsmod | grep sch_ets