In the Linux kernel, the following vulnerability has been resolved:
netsched: Prevent creation of classes with TCH_ROOT
The function qdisctreereducebacklog() uses TCHROOT as a termination condition when traversing up the qdisc tree to update parent backlog counters. However, if a class is created with classid TCH_ROOT, the traversal terminates prematurely at this class instead of reaching the actual root qdisc, causing parent statistics to be incorrectly maintained. In case of DRR, this could lead to a crash as reported by Mingi Cho.
Prevent the creation of any Qdisc class with classid TCHROOT (0xFFFFFFFF) across all qdisc types, as suggested by Jamal.
[
{
"deprecated": false,
"target": {
"file": "net/sched/sch_api.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"230531319479608824125035964863984622894",
"146912828441845468495603029387668956463",
"36506428299013431896214567623295033326"
]
},
"id": "CVE-2025-21971-0e57190c",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@78533c4a29ac3aeddce4b481770beaaa4f3bfb67",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "net/sched/sch_api.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"230531319479608824125035964863984622894",
"146912828441845468495603029387668956463",
"36506428299013431896214567623295033326"
]
},
"id": "CVE-2025-21971-11c7c6e6",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@003d92c91cdb5a64b25a9a74cb8543aac9a8bb48",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "net/sched/sch_api.c",
"function": "tc_ctl_tclass"
},
"digest": {
"length": 2172.0,
"function_hash": "336883085984940833134474295549790689765"
},
"id": "CVE-2025-21971-18c368c9",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0c3057a5a04d07120b3d0ec9c79568fceb9c921e",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "net/sched/sch_api.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"230531319479608824125035964863984622894",
"146912828441845468495603029387668956463",
"36506428299013431896214567623295033326"
]
},
"id": "CVE-2025-21971-525fa8ac",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0c3057a5a04d07120b3d0ec9c79568fceb9c921e",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "net/sched/sch_api.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"230531319479608824125035964863984622894",
"146912828441845468495603029387668956463",
"36506428299013431896214567623295033326"
]
},
"id": "CVE-2025-21971-756ff8c9",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5c3ca9cb48b51bd72bf76b8b05e24f3cd53db5e7",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "net/sched/sch_api.c",
"function": "tc_ctl_tclass"
},
"digest": {
"length": 2188.0,
"function_hash": "83668204135645628764470513615523260365"
},
"id": "CVE-2025-21971-9a5e1a81",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e5ee00607bbfc97ef1526ea95b6b2458ac9e7cb7",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "net/sched/sch_api.c",
"function": "tc_ctl_tclass"
},
"digest": {
"length": 2172.0,
"function_hash": "336883085984940833134474295549790689765"
},
"id": "CVE-2025-21971-9b01c648",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5c3ca9cb48b51bd72bf76b8b05e24f3cd53db5e7",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "net/sched/sch_api.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"230531319479608824125035964863984622894",
"146912828441845468495603029387668956463",
"36506428299013431896214567623295033326"
]
},
"id": "CVE-2025-21971-9fa7bd27",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e5ee00607bbfc97ef1526ea95b6b2458ac9e7cb7",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "net/sched/sch_api.c",
"function": "tc_ctl_tclass"
},
"digest": {
"length": 2188.0,
"function_hash": "83668204135645628764470513615523260365"
},
"id": "CVE-2025-21971-c5df29da",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@78533c4a29ac3aeddce4b481770beaaa4f3bfb67",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "net/sched/sch_api.c",
"function": "tc_ctl_tclass"
},
"digest": {
"length": 2294.0,
"function_hash": "228981175684981908951182335746212283566"
},
"id": "CVE-2025-21971-c70914cb",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@003d92c91cdb5a64b25a9a74cb8543aac9a8bb48",
"signature_version": "v1"
}
]