CVE-2025-21702

Expected behaviour: In case we reach scheduler's limit, pfifotailenqueue() will drop a packet in scheduler's queue and decrease scheduler's qlen by one. Then, pfifotailenqueue() enqueue new packet and increase scheduler's qlen by one. Finally, pfifotailenqueue() return NET_XMIT_CN status code.

Weird behaviour: In case we set sch->limit == 0 and trigger pfifotailenqueue() on a scheduler that has no packet, the 'drop a packet' step will do nothing. This means the scheduler's qlen still has value equal 0. Then, we continue to enqueue new packet and increase scheduler's qlen by one. In summary, we can leverage pfifotailenqueue() to increase qlen by one and return NET_XMIT_CN status code.

The problem is: Let's say we have two qdiscs: QdiscA and QdiscB. - QdiscA's type must have '->graft()' function to create parent/child relationship. Let's say QdiscA's type is hfsc. Enqueue packet to this qdisc will trigger hfsc_enqueue. - QdiscB's type is pfifoheaddrop. Enqueue packet to this qdisc will trigger pfifo_tail_enqueue. - QdiscB is configured to have sch->limit == 0. - QdiscA is configured to route the enqueued's packet to QdiscB.

Enqueue packet through QdiscA will lead to: - hfscenqueue(QdiscA) -> pfifotailenqueue(QdiscB) - QdiscB->q.qlen += 1 - pfifotailenqueue() return NET_XMIT_CN - hfscenqueue() check for NET_XMIT_SUCCESS and see NET_XMIT_CN => hfscenqueue() don't increase qlen of QdiscA.

The whole process lead to a situation where QdiscA->q.qlen == 0 and QdiscB->q.qlen == 1. Replace 'hfsc' with other type (for example: 'drr') still lead to the same problem. This violate the design where parent's qlen should equal to the sum of its childrens'qlen.

Bug impact: This issue can be used for user->kernel privilege escalation when it is reachable.

Database specific

{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/21xxx/CVE-2025-21702.json"
}

References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

57dbb2d83d100ea601c54fe129bfde0678db5dee

Fixed

78285b53266d6d51fa4ff504a23df03852eba84e

Fixed

7a9723ec27aff5674f1fd4934608937f1d650980

Fixed

a56a6e8589a9b98d8171611fbcc1e45a15fd2455

Fixed

020ecb76812a0526f4130ab5aeb6dc7c773e7ab9

Fixed

79a955ea4a2e5ddf4a36328959de0de496419888

Fixed

e40cb34b7f247fe2e366fd192700d1b4f38196ca

Fixed

b6a079c3b6f95378f26e2aeda520cb3176f7067b

Fixed

647cef20e649c576dff271e018d5d15d998b629d

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-21702.json"