LiveActive security incident?Get immediate response
CVE Record

CVE-2025-21653: net_sched: cls_flow: validate TCA_FLOW_RSHIFT attribute

In the Linux kernel, the following vulnerability has been resolved: net_sched: cls_flow: validate TCA_FLOW_RSHIFT attribute syzbot found that TCA_FLOW_RSHIFT attribute was not validated. Right shitfing a 32bit integer is undefined for large shift values. UBSAN: shift-out-of-bounds in net/sched/cls_flow.c:329:23 shift exponent 9445 is too large for 32-bit type 'u32' (aka 'unsigned int') CPU: 1 UID: 0 PID: 54 Comm: kworker/u8:3 Not tainted 6.13.0-rc3-syzkaller-00180-g4f619d518db9 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Workqueue: ipv6_addrconf addrconf_dad_work Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 ubsan_epilogue lib/ubsan.c:231 [inline] __ubsan_handle_shift_out_of_bounds+0x3c8/0x420 lib/ubsan.c:468 flow_classify+0x24d5/0x25b0 net/sched/cls_flow.c:329 tc_classify include/net/tc_wrapper.h:197 [inline] __tcf_classify net/sched/cls_api.c:1771 [inline] tcf_classify+0x420/0x1160 net/sched/cls_api.c:1867 sfb_classify net/sched/sch_sfb.c:260 [inline] sfb_enqueue+0x3ad/0x18b0 net/sched/sch_sfb.c:318 dev_qdisc_enqueue+0x4b/0x290 net/core/dev.c:3793 __dev_xmit_skb net/core/dev.c:3889 [inline] __dev_queue_xmit+0xf0e/0x3f50 net/core/dev.c:4400 dev_queue_xmit include/linux/netdevice.h:3168 [inline] neigh_hh_output include/net/neighbour.h:523 [inline] neigh_output include/net/neighbour.h:537 [inline] ip_finish_output2+0xd41/0x1390 net/ipv4/ip_output.c:236 iptunnel_xmit+0x55d/0x9b0 net/ipv4/ip_tunnel_core.c:82 udp_tunnel_xmit_skb+0x262/0x3b0 net/ipv4/udp_tunnel_core.c:173 geneve_xmit_skb drivers/net/geneve.c:916 [inline] geneve_xmit+0x21dc/0x2d00 drivers/net/geneve.c:1039 __netdev_start_xmit include/linux/netdevice.h:5002 [inline] netdev_start_xmit include/linux/netdevice.h:5011 [inline] xmit_one net/core/dev.c:3590 [inline] dev_hard_start_xmit+0x27a/0x7d0 net/core/dev.c:3606 __dev_queue_xmit+0x1b73/0x3f50 net/core/dev.c:4434

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2025-21653 is a Linux kernel bug in traffic-control packet classification. A missing validation check allows an oversized right-shift value, producing undefined kernel behavior detected by UBSAN. Public sources show kernel stable fixes and downstream advisories, but no CVSS score or confirmed active exploitation.

Executive priority

Treat this as a kernel maintenance issue with uncertain exploitability. Schedule updates through normal vulnerability remediation, accelerating for internet-facing network infrastructure, multi-tenant hosts, or vendor products explicitly covered by advisories.

Technical view

The flaw is in net/sched/cls_flow.c: TCA_FLOW_RSHIFT was not validated before shifting a 32-bit value. syzbot reported shift-out-of-bounds during flow_classify. Linux stable commits validate the attribute across supported branches. The source bundle does not state privilege requirements, remote reachability, or a proven exploit path.

Likely exposure

Exposure is tied to Linux kernels containing cls_flow traffic-control code and versions identified in the CVE record. Systems using kernel traffic control, network scheduling, or vendor appliances based on affected kernels should be prioritized for inventory review.

Exploitation context

The CVE is not listed as KEV in the supplied bundle, and no cited source claims active exploitation. Evidence comes from syzbot/UBSAN kernel testing and stable-kernel fixes, not public exploit reporting.

Researcher notes

The source evidence supports a missing bounds check on TCA_FLOW_RSHIFT and stable fixes. It does not establish exploitability, impact beyond undefined behavior, required privileges, or affected vendor product details. Avoid extrapolating beyond kernel and advisory data.

Mitigation direction

  • Apply vendor or distribution kernel updates that include the referenced stable fixes.
  • Check Debian LTS and relevant vendor advisories for packaged update status.
  • For appliances, follow vendor guidance rather than assuming upstream kernel patch availability.
  • Prioritize systems using Linux traffic control or network scheduling features.

Validation and detection

  • Inventory Linux kernel versions against the CVE record and vendor advisories.
  • Confirm patched kernels include the referenced cls_flow validation commits.
  • Review exposure of systems using traffic-control classifiers or advanced networking features.
  • Track Siemens and distribution advisories for product-specific applicability.
Prepared
Confidence
medium
Sources
12

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-21653 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
2ADP providers
12Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container
siemens-SADPADP container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxe5dfb815181fcb186d6080ac3a091eadff2d98fe, e5dfb815181fcb186d6080ac3a091eadff2d98fe, e5dfb815181fcb186d6080ac3a091eadff2d98fe, e5dfb815181fcb186d6080ac3a091eadff2d98fe, e5dfb815181fcb186d6080ac3a091eadff2d98fe, e5dfb815181fcb186d6080ac3a091eadff2d98fe, e5dfb815181fcb186d6080ac3a091eadff2d98feunaffected
LinuxLinux2.6.25, 0, 5.4.290, 5.10.234, 5.15.177, 6.1.125, 6.6.72, 6.12.10, 6.13affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.