CVE-2025-21692

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: sched: fix ets qdisc OOB Indexing

Haowei Yan <[email protected]> found that ets_class_from_arg() can

index an Out-Of-Bound class in ets_class_from_arg() when passed clid of

0. The overflow may cause local privilege escalation.

[ 18.852298] ------------[ cut here ]------------

[ 18.853271] UBSAN: array-index-out-of-bounds in net/sched/sch_ets.c:93:20

[ 18.853743] index 18446744073709551615 is out of range for type 'ets_class [16]'

[ 18.854254] CPU: 0 UID: 0 PID: 1275 Comm: poc Not tainted 6.12.6-dirty #17

[ 18.854821] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014

[ 18.856532] Call Trace:

[ 18.857441] <TASK>

[ 18.858227] dump_stack_lvl+0xc2/0xf0

[ 18.859607] dump_stack+0x10/0x20

[ 18.860908] __ubsan_handle_out_of_bounds+0xa7/0xf0

[ 18.864022] ets_class_change+0x3d6/0x3f0

[ 18.864322] tc_ctl_tclass+0x251/0x910

[ 18.864587] ? lock_a

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References