Security readout for executives and security teams
Plain-English summary
This Linux kernel flaw affects traffic-control queue configuration. A class can use an identifier reserved to mean “root,” causing the kernel to stop updating parent queue statistics too early. Accounting becomes inconsistent, and the DRR scheduler may crash the system. Evidence describes a local condition and crash, not confirmed remote compromise or active exploitation.
Executive priority
Treat this as accelerated high-severity kernel maintenance, prioritizing shared systems where untrusted local principals can alter traffic control. The supplied evidence does not support remote exploitation or an active campaign, so emergency incident response is not justified solely by this bundle. Kernel crash potential still warrants timely remediation.
Technical view
qdisc_tree_reduce_backlog() walks parent qdiscs until TC_H_ROOT. Permitting a qdisc class to use that same class ID makes traversal terminate before reaching the actual root, leaving backlog statistics incorrectly maintained. In DRR, the resulting inconsistency can cause a crash. Stable fixes prevent TC_H_ROOT class creation across all qdisc types.
Likely exposure
Potentially exposed systems run a kernel covered by the listed affected entries and allow a local principal to create traffic-control classes. Risk is most direct where DRR is used. Because the supplied version representation mixes releases and branch endpoints, confirm exact package exposure against vendor advisories or the corresponding stable fix commit.
Exploitation context
The bundle marks KEV false and provides no evidence of active exploitation or public weaponization. It documents a reported DRR crash. The CVSS vector models a local, low-privilege attack path, but the supplied evidence does not detail the exact permissions or configuration required.
Researcher notes
TC_H_ROOT is both the parent-walk termination sentinel and, before the fix, an accepted class ID. That collision prematurely stops backlog propagation. The resolution rejects this class ID globally. No CWE is supplied, and the sources do not demonstrate confidentiality or integrity exploitation despite the CVSS impact values.
Mitigation direction
- Apply vendor-supported kernel updates containing the relevant stable fix, following distribution guidance.
- Reboot or otherwise activate the updated kernel as directed, then confirm the running build.
- Until patched, restrict untrusted local access and permission to configure traffic-control classes.
- Review applicable vendor advisories for branch-specific package status and backport coverage.
Validation and detection
- Inventory active kernel versions and distribution package revisions across potentially affected systems.
- Map each build to its vendor advisory and corresponding stable fix commit.
- Confirm the active patched kernel rejects classes using the reserved TC_H_ROOT identifier.
- Review which local users or workloads can create or modify traffic-control classes.
- Examine kernel logs and crash records for DRR or qdisc-related failures.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-21971 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/e05d9938b1b0ac40b6054cc5fa0ccbd9afd5ed4cCVE reference, Linux
- https://git.kernel.org/stable/c/7a82fe67a9f4d7123d8e5ba8f0f0806c28695006CVE reference, Linux
- https://git.kernel.org/stable/c/003d92c91cdb5a64b25a9a74cb8543aac9a8bb48CVE reference, Linux
- https://git.kernel.org/stable/c/e5ee00607bbfc97ef1526ea95b6b2458ac9e7cb7CVE reference, Linux
- https://git.kernel.org/stable/c/78533c4a29ac3aeddce4b481770beaaa4f3bfb67CVE reference, Linux
- https://git.kernel.org/stable/c/5c3ca9cb48b51bd72bf76b8b05e24f3cd53db5e7CVE reference, Linux
- https://git.kernel.org/stable/c/94edfdfb9505ab608e86599d1d1e38c83816fc1cCVE reference, Linux
- https://git.kernel.org/stable/c/0c3057a5a04d07120b3d0ec9c79568fceb9c921eCVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/05/msg00045.htmlCVE reference, CVE
- https://lists.debian.org/debian-lts-announce/2025/05/msg00030.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.