In the Linux kernel, the following vulnerability has been resolved:
netsched: Prevent creation of classes with TCH_ROOT
The function qdisctreereducebacklog() uses TCHROOT as a termination condition when traversing up the qdisc tree to update parent backlog counters. However, if a class is created with classid TCH_ROOT, the traversal terminates prematurely at this class instead of reaching the actual root qdisc, causing parent statistics to be incorrectly maintained. In case of DRR, this could lead to a crash as reported by Mingi Cho.
Prevent the creation of any Qdisc class with classid TCHROOT (0xFFFFFFFF) across all qdisc types, as suggested by Jamal.
[
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@78533c4a29ac3aeddce4b481770beaaa4f3bfb67",
"digest": {
"threshold": 0.9,
"line_hashes": [
"230531319479608824125035964863984622894",
"146912828441845468495603029387668956463",
"36506428299013431896214567623295033326"
]
},
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "net/sched/sch_api.c"
},
"id": "CVE-2025-21971-0e57190c"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@003d92c91cdb5a64b25a9a74cb8543aac9a8bb48",
"digest": {
"threshold": 0.9,
"line_hashes": [
"230531319479608824125035964863984622894",
"146912828441845468495603029387668956463",
"36506428299013431896214567623295033326"
]
},
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "net/sched/sch_api.c"
},
"id": "CVE-2025-21971-11c7c6e6"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0c3057a5a04d07120b3d0ec9c79568fceb9c921e",
"digest": {
"length": 2172.0,
"function_hash": "336883085984940833134474295549790689765"
},
"signature_type": "Function",
"deprecated": false,
"target": {
"function": "tc_ctl_tclass",
"file": "net/sched/sch_api.c"
},
"id": "CVE-2025-21971-18c368c9"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e05d9938b1b0ac40b6054cc5fa0ccbd9afd5ed4c",
"digest": {
"length": 2286.0,
"function_hash": "296805051600576857791150834111880377570"
},
"signature_type": "Function",
"deprecated": false,
"target": {
"function": "tc_ctl_tclass",
"file": "net/sched/sch_api.c"
},
"id": "CVE-2025-21971-21e0e236"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e05d9938b1b0ac40b6054cc5fa0ccbd9afd5ed4c",
"digest": {
"threshold": 0.9,
"line_hashes": [
"230531319479608824125035964863984622894",
"146912828441845468495603029387668956463",
"36506428299013431896214567623295033326"
]
},
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "net/sched/sch_api.c"
},
"id": "CVE-2025-21971-2c484ceb"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0c3057a5a04d07120b3d0ec9c79568fceb9c921e",
"digest": {
"threshold": 0.9,
"line_hashes": [
"230531319479608824125035964863984622894",
"146912828441845468495603029387668956463",
"36506428299013431896214567623295033326"
]
},
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "net/sched/sch_api.c"
},
"id": "CVE-2025-21971-525fa8ac"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5c3ca9cb48b51bd72bf76b8b05e24f3cd53db5e7",
"digest": {
"threshold": 0.9,
"line_hashes": [
"230531319479608824125035964863984622894",
"146912828441845468495603029387668956463",
"36506428299013431896214567623295033326"
]
},
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "net/sched/sch_api.c"
},
"id": "CVE-2025-21971-756ff8c9"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@94edfdfb9505ab608e86599d1d1e38c83816fc1c",
"digest": {
"threshold": 0.9,
"line_hashes": [
"230531319479608824125035964863984622894",
"146912828441845468495603029387668956463",
"36506428299013431896214567623295033326"
]
},
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "net/sched/sch_api.c"
},
"id": "CVE-2025-21971-8820c14c"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7a82fe67a9f4d7123d8e5ba8f0f0806c28695006",
"digest": {
"threshold": 0.9,
"line_hashes": [
"230531319479608824125035964863984622894",
"146912828441845468495603029387668956463",
"36506428299013431896214567623295033326"
]
},
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "net/sched/sch_api.c"
},
"id": "CVE-2025-21971-934b9138"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e5ee00607bbfc97ef1526ea95b6b2458ac9e7cb7",
"digest": {
"length": 2188.0,
"function_hash": "83668204135645628764470513615523260365"
},
"signature_type": "Function",
"deprecated": false,
"target": {
"function": "tc_ctl_tclass",
"file": "net/sched/sch_api.c"
},
"id": "CVE-2025-21971-9a5e1a81"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5c3ca9cb48b51bd72bf76b8b05e24f3cd53db5e7",
"digest": {
"length": 2172.0,
"function_hash": "336883085984940833134474295549790689765"
},
"signature_type": "Function",
"deprecated": false,
"target": {
"function": "tc_ctl_tclass",
"file": "net/sched/sch_api.c"
},
"id": "CVE-2025-21971-9b01c648"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e5ee00607bbfc97ef1526ea95b6b2458ac9e7cb7",
"digest": {
"threshold": 0.9,
"line_hashes": [
"230531319479608824125035964863984622894",
"146912828441845468495603029387668956463",
"36506428299013431896214567623295033326"
]
},
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "net/sched/sch_api.c"
},
"id": "CVE-2025-21971-9fa7bd27"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7a82fe67a9f4d7123d8e5ba8f0f0806c28695006",
"digest": {
"length": 2286.0,
"function_hash": "296805051600576857791150834111880377570"
},
"signature_type": "Function",
"deprecated": false,
"target": {
"function": "tc_ctl_tclass",
"file": "net/sched/sch_api.c"
},
"id": "CVE-2025-21971-be8b098d"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@78533c4a29ac3aeddce4b481770beaaa4f3bfb67",
"digest": {
"length": 2188.0,
"function_hash": "83668204135645628764470513615523260365"
},
"signature_type": "Function",
"deprecated": false,
"target": {
"function": "tc_ctl_tclass",
"file": "net/sched/sch_api.c"
},
"id": "CVE-2025-21971-c5df29da"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@003d92c91cdb5a64b25a9a74cb8543aac9a8bb48",
"digest": {
"length": 2294.0,
"function_hash": "228981175684981908951182335746212283566"
},
"signature_type": "Function",
"deprecated": false,
"target": {
"function": "tc_ctl_tclass",
"file": "net/sched/sch_api.c"
},
"id": "CVE-2025-21971-c70914cb"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@94edfdfb9505ab608e86599d1d1e38c83816fc1c",
"digest": {
"length": 2172.0,
"function_hash": "336883085984940833134474295549790689765"
},
"signature_type": "Function",
"deprecated": false,
"target": {
"function": "tc_ctl_tclass",
"file": "net/sched/sch_api.c"
},
"id": "CVE-2025-21971-faac2b8a"
}
]