CVE-2025-21702

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

pfifo_tail_enqueue: Drop new packet when sch->limit == 0

Expected behaviour:

In case we reach scheduler's limit, pfifo_tail_enqueue() will drop a

packet in scheduler's queue and decrease scheduler's qlen by one.

Then, pfifo_tail_enqueue() enqueue new packet and increase

scheduler's qlen by one. Finally, pfifo_tail_enqueue() return

`NET_XMIT_CN` status code.

Weird behaviour:

In case we set `sch->limit == 0` and trigger pfifo_tail_enqueue() on a

scheduler that has no packet, the 'drop a packet' step will do nothing.

This means the scheduler's qlen still has value equal 0.

Then, we continue to enqueue new packet and increase scheduler's qlen by

one. In summary, we can leverage pfifo_tail_enqueue() to increase qlen by

one and return `NET_XMIT_CN` status code.

The problem is:

Let's say we have two qdiscs: Qdisc_A and Qdisc_B.

- Qdisc_A's type must have '->graft()' function to create parent/child relationship.

Let's

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References