CVE-2025-21692

Published Feb 10, 2025

Last updated 5 months ago

CVSS high 7.8
Linux Kernel
Ubuntu

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-21692 is an out-of-bounds indexing vulnerability within the Enhanced Transmission Selection (ETS) scheduler component of the Linux kernel. Discovered by Haowei Yan, the vulnerability occurs in the `etsclassfrom_arg()` function when it receives a class ID (clid) of 0, leading to an array-index-out-of-bounds error. The vulnerability affects Linux kernel versions from 5.6 through 6.13-rc7. The vulnerability exists in the `net/sched/sch_ets.c` file, where the `etsclassfromarg()` function can index an out-of-bounds class when passed a clid of 0. This can potentially allow a local attacker to escalate their privileges and gain unauthorized access to sensitive system resources.

Description
In the Linux kernel, the following vulnerability has been resolved: net: sched: fix ets qdisc OOB Indexing Haowei Yan <g1042620637@gmail.com> found that ets_class_from_arg() can index an Out-Of-Bound class in ets_class_from_arg() when passed clid of 0. The overflow may cause local privilege escalation. [ 18.852298] ------------[ cut here ]------------ [ 18.853271] UBSAN: array-index-out-of-bounds in net/sched/sch_ets.c:93:20 [ 18.853743] index 18446744073709551615 is out of range for type 'ets_class [16]' [ 18.854254] CPU: 0 UID: 0 PID: 1275 Comm: poc Not tainted 6.12.6-dirty #17 [ 18.854821] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 [ 18.856532] Call Trace: [ 18.857441] <TASK> [ 18.858227] dump_stack_lvl+0xc2/0xf0 [ 18.859607] dump_stack+0x10/0x20 [ 18.860908] __ubsan_handle_out_of_bounds+0xa7/0xf0 [ 18.864022] ets_class_change+0x3d6/0x3f0 [ 18.864322] tc_ctl_tclass+0x251/0x910 [ 18.864587] ? lock_acquire+0x5e/0x140 [ 18.865113] ? __mutex_lock+0x9c/0xe70 [ 18.866009] ? __mutex_lock+0xa34/0xe70 [ 18.866401] rtnetlink_rcv_msg+0x170/0x6f0 [ 18.866806] ? __lock_acquire+0x578/0xc10 [ 18.867184] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 18.867503] netlink_rcv_skb+0x59/0x110 [ 18.867776] rtnetlink_rcv+0x15/0x30 [ 18.868159] netlink_unicast+0x1c3/0x2b0 [ 18.868440] netlink_sendmsg+0x239/0x4b0 [ 18.868721] ____sys_sendmsg+0x3e2/0x410 [ 18.869012] ___sys_sendmsg+0x88/0xe0 [ 18.869276] ? rseq_ip_fixup+0x198/0x260 [ 18.869563] ? rseq_update_cpu_node_id+0x10a/0x190 [ 18.869900] ? trace_hardirqs_off+0x5a/0xd0 [ 18.870196] ? syscall_exit_to_user_mode+0xcc/0x220 [ 18.870547] ? do_syscall_64+0x93/0x150 [ 18.870821] ? __memcg_slab_free_hook+0x69/0x290 [ 18.871157] __sys_sendmsg+0x69/0xd0 [ 18.871416] __x64_sys_sendmsg+0x1d/0x30 [ 18.871699] x64_sys_call+0x9e2/0x2670 [ 18.871979] do_syscall_64+0x87/0x150 [ 18.873280] ? do_syscall_64+0x93/0x150 [ 18.874742] ? lock_release+0x7b/0x160 [ 18.876157] ? do_user_addr_fault+0x5ce/0x8f0 [ 18.877833] ? irqentry_exit_to_user_mode+0xc2/0x210 [ 18.879608] ? irqentry_exit+0x77/0xb0 [ 18.879808] ? clear_bhb_loop+0x15/0x70 [ 18.880023] ? clear_bhb_loop+0x15/0x70 [ 18.880223] ? clear_bhb_loop+0x15/0x70 [ 18.880426] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 18.880683] RIP: 0033:0x44a957 [ 18.880851] Code: ff ff e8 fc 00 00 00 66 2e 0f 1f 84 00 00 00 00 00 66 90 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 8974 24 10 [ 18.881766] RSP: 002b:00007ffcdd00fad8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 18.882149] RAX: ffffffffffffffda RBX: 00007ffcdd010db8 RCX: 000000000044a957 [ 18.882507] RDX: 0000000000000000 RSI: 00007ffcdd00fb70 RDI: 0000000000000003 [ 18.885037] RBP: 00007ffcdd010bc0 R08: 000000000703c770 R09: 000000000703c7c0 [ 18.887203] R10: 0000000000000080 R11: 0000000000000246 R12: 0000000000000001 [ 18.888026] R13: 00007ffcdd010da8 R14: 00000000004ca7d0 R15: 0000000000000001 [ 18.888395] </TASK> [ 18.888610] ---[ end trace ]---
Source
416baaa9-dc9f-4396-8d5f-8c081fb06d67
NVD status
Modified
Products
linux_kernel

Risk scores

CVSS 3.1

Type
Primary
Base score
7.8
Impact score
5.9
Exploitability score
1.8
Vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity
HIGH

Weaknesses

nvd@nist.gov
CWE-129
134c704f-9b21-4f2e-91b3-4a467353bcc0
CWE-129

Social media

Hype score
Not currently trending

  1. Linux kernel just got another dangerous patch - CVE-2025-21692 (CVSS3.1 7.8); if you run kernels 5.6 - 6.13 rc, patch now or assume compromise. ๐Ÿงต Here's what happened... https://t.co/WrURejLrkc

    @dispatchy_ai

    3 Oct 2025

    27 Impressions

    0 Retweets

    2 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  2. ๐Ÿšจ #CVE-2025-21692: The VSOCK Vulnerability Unlocking #Linux Kernel Privileges https://t.co/FdJsZ8rpHH Educational Purposes!

    @UndercodeUpdate

    29 Sept 2025

    70 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  3. Linuxใ‚ซใƒผใƒใƒซใฎEnhanced Transmission Selection (ETS)ใซใŠใ‘ใ‚‹ใ€้ ้š”ใ‚ณใƒผใƒ‰ๅฎŸ่กŒใŒๅฏ่ƒฝใช่„†ๅผฑๆ€งCVE-2025-21692ใซใคใ„ใฆใ€‚ใƒญใ‚ธใƒƒใ‚ฏไธๅ‚™ใ€‚ใ‚ฏใƒฉใ‚นIDใŒ0ใซใชใ‚‹ใ“ใจใŒใ‚ใ‚Šๅพ—ใ‚‹ใ“ใจใฎ่ฆ‹่ฝใจใ—ใซใ‚ˆใ‚‹ๅขƒ็•Œๅค–ใƒกใƒขใƒช่ชญใฟ่พผใฟใ€‚ https:/

    @__kokumoto

    18 Sept 2025

    968 Impressions

    1 Retweet

    7 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  4. CRITICAL VULNERABILITY ALERT A new RCE flaw (CVE-2025-21692) in the Linux kernel allows for full host compromise. Patches are availableโ€”act now! https://t.co/cgIMRZlzhe https://t.co/n0M2u0zTOT

    @cyberbivash

    18 Sept 2025

    1 Impression

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  5. Ello, I recently wrote a writeup for CVE-2025-21692, an out of bounds access in the ETS qdisc, https://t.co/wmO4pudZrR. Was curious to see any corrections or feedback ppl may have as im not tremendously well versed in kernel exploitation and would love some pointers. Tq

    @movx64

    16 Sept 2025

    49 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  6. Proof of concept source code and misc files for my CVE-2025-21692 exploit, kernel version 6.6.75 https://t.co/YVN6i3JqmR

    @Dinosn

    16 Sept 2025

    3973 Impressions

    16 Retweets

    60 Likes

    28 Bookmarks

    0 Replies

    0 Quotes

  7. GitHub - volticks/CVE-2025-21692-poc: Proof of concept source code and misc files for my CVE-2025-21692 exploit, kernel version 6.6.75 https://t.co/9Miq0vbr4b

    @akaclandestine

    15 Sept 2025

    2746 Impressions

    9 Retweets

    26 Likes

    18 Bookmarks

    0 Replies

    0 Quotes

  8. GitHub - volticks/CVE-2025-21692-poc: Proof of concept source code and misc files for my CVE-2025-21692 exploit, kernel version 6.6.75 - https://t.co/IFkx3bUHKG

    @piedpiper1616

    15 Sept 2025

    4387 Impressions

    22 Retweets

    66 Likes

    29 Bookmarks

    0 Replies

    0 Quotes

  9. ๐Ÿšจ CVE-2025-21692 โ“ ๐Ÿข Linux - Linux ๐Ÿ—๏ธ dcc68b4d8084e1ac9af0d4022d6b1aff6a139a33 ๐Ÿ”— https://t.co/f7C2dL0HV4 ๐Ÿ”— https://t.co/KbXcTRx3IZ ๐Ÿ”— https://t.co/npfS0ArzRW ๐Ÿ”— https://t.co/ossSsM5XQg ๐Ÿ”— https://t.co/Ja49ZI0wWy ๐Ÿ”— https://t.co/ROGuvOA9mx #CyberCron #VulnAlert https://t.co/

    @cybercronai

    13 Feb 2025

    23 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

  10. ๐Ÿšจ CVE-2025-21692 โ“ ๐Ÿข Linux - Linux ๐Ÿ—๏ธ dcc68b4d8084e1ac9af0d4022d6b1aff6a139a33 ๐Ÿ”— https://t.co/f7C2dL0HV4 ๐Ÿ”— https://t.co/KbXcTRx3IZ ๐Ÿ”— https://t.co/npfS0ArzRW ๐Ÿ”— https://t.co/ossSsM5XQg ๐Ÿ”— https://t.co/Ja49ZI0wWy ๐Ÿ”— https://t.co/ROGuvOA9mx #CyberCron #VulnAlert https://t.co/p

    @cybercronai

    10 Feb 2025

    19 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

Configurations

Related CVEs

  1. Issue summary: The DTLS retransmission logic does not correctly handle a handshake message write that is suspended part-way through. The retransmitted message can be read past the message buffer and the retransmission overwrites the internal state the suspended write needs to resume correctly. Impact summary: The retransmitted message can disclose a heap memory to the peer as plaintext handshake data or cause a crash and a Denial of Service when the read reaches an unmapped memory region. CWE: CWE-125: Out-of-bounds Read Description: DTLS handshake messages can be written out in multiple fragments, and a write can suspend mid-message (returning WANT_WRITE) if the underlying transport temporarily cannot accept more data. While such a write is suspended, the DTLS retransmission timer may independently fire and ask the retransmission logic to resend an earlier, already-acknowledged-as-sent message from its retransmit queue. The retransmission logic reused the same internal buffer and position tracking as the message that was still being written, without resetting the position back to the start of the message being retransmitted. As a result the retransmission was read starting from wherever the suspended write had left off, producing a mislabelled message whose body was leftover bytes from the other, larger message still in flight - content that was never meant to be sent at that point, and which could run past the end of the allocated buffer. Separately, even when the retransmission is positioned correctly, allowing it to run to completion while another write is suspended overwrites the same shared bookkeeping that the suspended write depends on to resume. When the application later resumes the suspended write (via a subsequent SSL_read(), SSL_write(), SSL_accept(), or SSL_connect() call), it finds that bookkeeping in a state inconsistent with the message and aborts the process in a debugging build. The fix resets the retransmission's read position to the start of the message before resending, and skips retransmission entirely whenever a handshake write is still suspended, deferring to the next call that resumes it instead. FIPS impact: no The affected code is outside the FIPS module boundary.โ€ขCVE-2026-84782
  2. In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Check write tracking in all address spaces kvm_gfn_is_write_tracked() checks only the supplied memslot, but page tracking is per-address-space and shadow pages are shared across all address spaces. With SMM, a GFN can therefore be write-tracked in one address space and appear untracked through the other. Check the supplied slot first, then the slot for the other address space. This ensures all callers honor write tracking regardless of the active address space. In particular, it prevents mmu_try_to_unsync_pages() from marking an upper-level shadow page unsync and eventually triggering the BUG in pte_list_remove(). [invert direction of the conditional. - Paolo]โ€ขCVE-2026-98164
  3. ZoneMinder versions 1.37.0 before 1.38.0 contain a path traversal vulnerability in the files view that allows authenticated users to read arbitrary files. The path parameter is not properly validated before being passed to output_file, enabling attackers with Events view permission to access sensitive files like configuration files containing database credentials.โ€ขCVE-2024-58386
  4. In the Linux kernel, the following vulnerability has been resolved: cgroup: Avoid iteration of dying tasks with zero refcount The commit 260fbcb92bbea ("cgroup: Move dying_tasks cleanup from cgroup_task_release() to cgroup_task_free()") extended the lifetime of tasks on the dying_tasks list. The iterators have provision to go through dying_tasks because of dying threadgroup leaders or explicit CSS_TASK_ITER_WITH_DEAD, however, it was expected that such tasks can obtain a new reference (that is possible before cgroup_task_release()/put_task_struct_rcu_user()). The tasks after cgroup_task_release() and before cgroup_task_free() are subject to race when they may or may not have ->usage count > 0. The race window is between css_task_iter_next() invocations when css_set_lock is released and we may arrive at a new ->task_pos. The iterator should not attempt to resurrect tasks whose ->usage count dropped to zero. (When that happens, __put_task_struct_rcu_cb() is already imminent and the returned task_struct would could be used after free.) As for the fix, we cannot simply check the signal->live count of a task on the dying list because that won't distinguish regular zombies waiting to be reaped from RCU remnant tasks that are going to be free'd. Therefore add an extra check to rule out ->usage==0 tasks from any iteration. The repeat: loop in css_task_iter_advance() doesn't consider ->usage count, so add a new loop to css_task_iter_next() to skip de-used tasks on the dying_list. Rough illustration of the possible race R (reader of cgroup.procs) T (thread) L (group leader) --------------------------------- -------------------------------- -------------------------------- L exits, signal->live > 0 cgroup_task_dead(L) css_set_skip_task_iters() // skips only cset->tasks list_add_tail(&L->cg_list, &cset->dying_tasks) css_task_iter_next() take css_set_lock css_task_iter_advance() leader && signal->live != 0 => it->task_pos = &L->cg_list release css_set_lock T exits --signal->live == 0 cgroup_task_dead(T) // css_set_lock release_task(T) cgroup_task_release(T) release_task(L) // zap_leader cgroup_task_release(L) put_task_struct_rcu_user(L) ...RCU... put_task_struct(L) L->usage = 0 /* L still on dying_tasks */ ...RCU... __put_task_struct(L) css_task_iter_next() // another iteration take css_set_lock it->task_pos = &L->cg_list get_task_struct(L) => addition on 0 drop css_set_lock cgroup_task_free(L) css_set_skip_task_iters() // dying skip comes too late free_task(L) cgroup_procs_show() task_pid_vnr(L)โ€ขCVE-2026-98163
  5. In the Linux kernel, the following vulnerability has been resolved: smb/server: fix tree connection leak in smb2_tree_connect() See the procedure below: smb2_tree_connect ksmbd_tree_conn_connect xa_store(&sess->tree_conns, tree_conn->id, tree_conn) ksmbd_counter_inc(KSMBD_COUNTER_TREE_CONNS) ksmbd_share_tree_conn_inc(sc) ksmbd_iov_pin_rsp // fail status.ret = KSMBD_TREE_CONN_STATUS_NOMEM // do not disconnect tree_conn Disconnect the new tree connection if ksmbd_iov_pin_rsp() fails.โ€ขCVE-2026-98162

References

Sources include official advisories and independent security research.