CVE-2025-21703

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2025-21703
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-21703.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-21703
Downstream
Related
Published
2025-02-18T14:37:44.261Z
Modified
2025-11-20T09:32:00.251672Z
Severity
  • 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
netem: Update sch->q.qlen before qdisc_tree_reduce_backlog()
Details

In the Linux kernel, the following vulnerability has been resolved:

netem: Update sch->q.qlen before qdisctreereduce_backlog()

qdisctreereducebacklog() notifies parent qdisc only if child qdisc becomes empty, therefore we need to reduce the backlog of the child qdisc before calling it. Otherwise it would miss the opportunity to call cops->qlennotify(), in the case of DRR, it resulted in UAF since DRR uses ->qlen_notify() to maintain its active list.

References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
83c6ab12f08dcc09d4c5ac86fdb89736b28f1d31
Fixed
e395fec75ac2dbffc99b4bce57b7f1f3c5449f2c
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
216509dda290f6db92c816dd54b83c1df9da9e76
Fixed
7f31d74fcc556a9166b1bb20515542de7bb939d1
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
c2047b0e216c8edce227d7c42f99ac2877dad0e4
Fixed
98a2c685293aae122f688cde11d9334dddc5d207
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
10df49cfca73dfbbdb6c4150d859f7e8926ae427
Fixed
7b79ca9a1de6a428d486ff52fb3d602321c08f55
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
3824c5fad18eeb7abe0c4fc966f29959552dca3e
Fixed
1f8e3f4a4b8b90ad274dfbc66fc7d55cb582f4d5
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
356078a5c55ec8d2061fcc009fb8599f5b0527f9
Fixed
6312555249082d6d8cc5321ff725df05482d8b83
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
f8d4bc455047cf3903cd6f85f49978987dbb3027
Fixed
839ecc583fa00fab785fde1c85a326743657fd32
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
f8d4bc455047cf3903cd6f85f49978987dbb3027
Fixed
638ba5089324796c2ee49af10427459c2de35f71

Affected versions

v5.*

v5.10.232
v5.10.233
v5.10.234
v5.15.175
v5.15.176
v5.15.177
v5.15.178
v5.4.288
v5.4.289
v5.4.290

v6.*

v6.1.121
v6.1.122
v6.1.123
v6.1.124
v6.1.125
v6.1.126
v6.1.127
v6.1.128
v6.12.10
v6.12.11
v6.12.12
v6.12.13
v6.12.6
v6.12.7
v6.12.8
v6.12.9
v6.13
v6.13-rc2
v6.13-rc3
v6.13-rc4
v6.13-rc5
v6.13-rc6
v6.13-rc7
v6.13.1
v6.13.2
v6.6.67
v6.6.68
v6.6.69
v6.6.70
v6.6.71
v6.6.72
v6.6.73
v6.6.74
v6.6.75
v6.6.76
v6.6.77

Database specific

vanir_signatures

[
    {
        "id": "CVE-2025-21703-1c20b2d2",
        "signature_version": "v1",
        "digest": {
            "function_hash": "37764292924407054557369110569518862031",
            "length": 1582.0
        },
        "deprecated": false,
        "signature_type": "Function",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1f8e3f4a4b8b90ad274dfbc66fc7d55cb582f4d5",
        "target": {
            "file": "net/sched/sch_netem.c",
            "function": "netem_dequeue"
        }
    },
    {
        "id": "CVE-2025-21703-2115a447",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "95508479228908828801924465110865064741",
                "53062837617568029068665012040983013753",
                "151889648915571590863255247286514610113",
                "105158028507271463602419018784584674797",
                "100926989644995395225521035304748946587",
                "9762562964896877281465193716129610248"
            ]
        },
        "deprecated": false,
        "signature_type": "Line",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e395fec75ac2dbffc99b4bce57b7f1f3c5449f2c",
        "target": {
            "file": "net/sched/sch_netem.c"
        }
    },
    {
        "id": "CVE-2025-21703-29db609c",
        "signature_version": "v1",
        "digest": {
            "function_hash": "37764292924407054557369110569518862031",
            "length": 1582.0
        },
        "deprecated": false,
        "signature_type": "Function",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7f31d74fcc556a9166b1bb20515542de7bb939d1",
        "target": {
            "file": "net/sched/sch_netem.c",
            "function": "netem_dequeue"
        }
    },
    {
        "id": "CVE-2025-21703-4180d7de",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "95508479228908828801924465110865064741",
                "53062837617568029068665012040983013753",
                "151889648915571590863255247286514610113",
                "105158028507271463602419018784584674797",
                "100926989644995395225521035304748946587",
                "9762562964896877281465193716129610248"
            ]
        },
        "deprecated": false,
        "signature_type": "Line",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@839ecc583fa00fab785fde1c85a326743657fd32",
        "target": {
            "file": "net/sched/sch_netem.c"
        }
    },
    {
        "id": "CVE-2025-21703-47dd9d99",
        "signature_version": "v1",
        "digest": {
            "function_hash": "37764292924407054557369110569518862031",
            "length": 1582.0
        },
        "deprecated": false,
        "signature_type": "Function",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@839ecc583fa00fab785fde1c85a326743657fd32",
        "target": {
            "file": "net/sched/sch_netem.c",
            "function": "netem_dequeue"
        }
    },
    {
        "id": "CVE-2025-21703-508233f9",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "95508479228908828801924465110865064741",
                "53062837617568029068665012040983013753",
                "151889648915571590863255247286514610113",
                "105158028507271463602419018784584674797",
                "100926989644995395225521035304748946587",
                "9762562964896877281465193716129610248"
            ]
        },
        "deprecated": false,
        "signature_type": "Line",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7f31d74fcc556a9166b1bb20515542de7bb939d1",
        "target": {
            "file": "net/sched/sch_netem.c"
        }
    },
    {
        "id": "CVE-2025-21703-736a13ce",
        "signature_version": "v1",
        "digest": {
            "function_hash": "37764292924407054557369110569518862031",
            "length": 1582.0
        },
        "deprecated": false,
        "signature_type": "Function",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@638ba5089324796c2ee49af10427459c2de35f71",
        "target": {
            "file": "net/sched/sch_netem.c",
            "function": "netem_dequeue"
        }
    },
    {
        "id": "CVE-2025-21703-92157ba3",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "95508479228908828801924465110865064741",
                "53062837617568029068665012040983013753",
                "151889648915571590863255247286514610113",
                "105158028507271463602419018784584674797",
                "100926989644995395225521035304748946587",
                "9762562964896877281465193716129610248"
            ]
        },
        "deprecated": false,
        "signature_type": "Line",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7b79ca9a1de6a428d486ff52fb3d602321c08f55",
        "target": {
            "file": "net/sched/sch_netem.c"
        }
    },
    {
        "id": "CVE-2025-21703-9509a9e7",
        "signature_version": "v1",
        "digest": {
            "function_hash": "37764292924407054557369110569518862031",
            "length": 1582.0
        },
        "deprecated": false,
        "signature_type": "Function",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7b79ca9a1de6a428d486ff52fb3d602321c08f55",
        "target": {
            "file": "net/sched/sch_netem.c",
            "function": "netem_dequeue"
        }
    },
    {
        "id": "CVE-2025-21703-9836feb6",
        "signature_version": "v1",
        "digest": {
            "function_hash": "37764292924407054557369110569518862031",
            "length": 1582.0
        },
        "deprecated": false,
        "signature_type": "Function",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@98a2c685293aae122f688cde11d9334dddc5d207",
        "target": {
            "file": "net/sched/sch_netem.c",
            "function": "netem_dequeue"
        }
    },
    {
        "id": "CVE-2025-21703-b8cff622",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "95508479228908828801924465110865064741",
                "53062837617568029068665012040983013753",
                "151889648915571590863255247286514610113",
                "105158028507271463602419018784584674797",
                "100926989644995395225521035304748946587",
                "9762562964896877281465193716129610248"
            ]
        },
        "deprecated": false,
        "signature_type": "Line",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@638ba5089324796c2ee49af10427459c2de35f71",
        "target": {
            "file": "net/sched/sch_netem.c"
        }
    },
    {
        "id": "CVE-2025-21703-d001c2c0",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "95508479228908828801924465110865064741",
                "53062837617568029068665012040983013753",
                "151889648915571590863255247286514610113",
                "105158028507271463602419018784584674797",
                "100926989644995395225521035304748946587",
                "9762562964896877281465193716129610248"
            ]
        },
        "deprecated": false,
        "signature_type": "Line",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1f8e3f4a4b8b90ad274dfbc66fc7d55cb582f4d5",
        "target": {
            "file": "net/sched/sch_netem.c"
        }
    },
    {
        "id": "CVE-2025-21703-d2884ea8",
        "signature_version": "v1",
        "digest": {
            "function_hash": "37764292924407054557369110569518862031",
            "length": 1582.0
        },
        "deprecated": false,
        "signature_type": "Function",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e395fec75ac2dbffc99b4bce57b7f1f3c5449f2c",
        "target": {
            "file": "net/sched/sch_netem.c",
            "function": "netem_dequeue"
        }
    },
    {
        "id": "CVE-2025-21703-e1f34c89",
        "signature_version": "v1",
        "digest": {
            "function_hash": "37764292924407054557369110569518862031",
            "length": 1582.0
        },
        "deprecated": false,
        "signature_type": "Function",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6312555249082d6d8cc5321ff725df05482d8b83",
        "target": {
            "file": "net/sched/sch_netem.c",
            "function": "netem_dequeue"
        }
    },
    {
        "id": "CVE-2025-21703-e48c5c04",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "95508479228908828801924465110865064741",
                "53062837617568029068665012040983013753",
                "151889648915571590863255247286514610113",
                "105158028507271463602419018784584674797",
                "100926989644995395225521035304748946587",
                "9762562964896877281465193716129610248"
            ]
        },
        "deprecated": false,
        "signature_type": "Line",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6312555249082d6d8cc5321ff725df05482d8b83",
        "target": {
            "file": "net/sched/sch_netem.c"
        }
    },
    {
        "id": "CVE-2025-21703-f4d30bfa",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "95508479228908828801924465110865064741",
                "53062837617568029068665012040983013753",
                "151889648915571590863255247286514610113",
                "105158028507271463602419018784584674797",
                "100926989644995395225521035304748946587",
                "9762562964896877281465193716129610248"
            ]
        },
        "deprecated": false,
        "signature_type": "Line",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@98a2c685293aae122f688cde11d9334dddc5d207",
        "target": {
            "file": "net/sched/sch_netem.c"
        }
    }
]

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
5.4.291
Type
ECOSYSTEM
Events
Introduced
5.5.0
Fixed
5.10.235
Type
ECOSYSTEM
Events
Introduced
5.11.0
Fixed
5.15.179
Type
ECOSYSTEM
Events
Introduced
5.16.0
Fixed
6.1.129
Type
ECOSYSTEM
Events
Introduced
6.2.0
Fixed
6.6.78
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.12.14
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.13.3