CVE-2025-21857

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net/sched: cls_api: fix error handling causing NULL dereference

tcf_exts_miss_cookie_base_alloc() calls xa_alloc_cyclic() which can

return 1 if the allocation succeeded after wrapping. This was treated as

an error, with value 1 returned to caller tcf_exts_init_ex() which sets

exts->actions to NULL and returns 1 to caller fl_change().

fl_change() treats err == 1 as success, calling tcf_exts_validate_ex()

which calls tcf_action_init() with exts->actions as argument, where it

is dereferenced.

Example trace:

BUG: kernel NULL pointer dereference, address: 0000000000000000

CPU: 114 PID: 16151 Comm: handler114 Kdump: loaded Not tainted 5.14.0-503.16.1.el9_5.x86_64 #1

RIP: 0010:tcf_action_init+0x1f8/0x2c0

Call Trace:

tcf_action_init+0x1f8/0x2c0

tcf_exts_validate_ex+0x175/0x190

fl_change+0x537/0x1120 [cls_flower]

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References