VYPR
← All advisories
High severity7.8NVD Advisory· Published Feb 18, 2025· Updated May 12, 2026

CVE-2025-21702

CVE-2025-21702

Description

In the Linux kernel, the following vulnerability has been resolved:

pfifo_tail_enqueue: Drop new packet when sch->limit == 0

Expected behaviour: In case we reach scheduler's limit, pfifo_tail_enqueue() will drop a packet in scheduler's queue and decrease scheduler's qlen by one. Then, pfifo_tail_enqueue() enqueue new packet and increase scheduler's qlen by one. Finally, pfifo_tail_enqueue() return NET_XMIT_CN status code.

Weird behaviour: In case we set sch->limit == 0 and trigger pfifo_tail_enqueue() on a scheduler that has no packet, the 'drop a packet' step will do nothing. This means the scheduler's qlen still has value equal 0. Then, we continue to enqueue new packet and increase scheduler's qlen by one. In summary, we can leverage pfifo_tail_enqueue() to increase qlen by one and return NET_XMIT_CN status code.

The problem is: Let's say we have two qdiscs: Qdisc_A and Qdisc_B. - Qdisc_A's type must have '->graft()' function to create parent/child relationship. Let's say Qdisc_A's type is hfsc. Enqueue packet to this qdisc will trigger hfsc_enqueue. - Qdisc_B's type is pfifo_head_drop. Enqueue packet to this qdisc will trigger pfifo_tail_enqueue. - Qdisc_B is configured to have sch->limit == 0. - Qdisc_A is configured to route the enqueued's packet to Qdisc_B.

Enqueue packet through Qdisc_A will lead to: - hfsc_enqueue(Qdisc_A) -> pfifo_tail_enqueue(Qdisc_B) - Qdisc_B->q.qlen += 1 - pfifo_tail_enqueue() return NET_XMIT_CN - hfsc_enqueue() check for NET_XMIT_SUCCESS and see NET_XMIT_CN => hfsc_enqueue() don't increase qlen of Qdisc_A.

The whole process lead to a situation where Qdisc_A->q.qlen == 0 and Qdisc_B->q.qlen == 1. Replace 'hfsc' with other type (for example: 'drr') still lead to the same problem. This violate the design where parent's qlen should equal to the sum of its childrens'qlen.

Bug impact: This issue can be used for user->kernel privilege escalation when it is reachable.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

A pfifo_tail_enqueue bug in the Linux kernel allows qlen mismatch across qdiscs, potentially leading to privilege escalation.

Vulnerability

Description

The vulnerability lies in the Linux kernel's pfifo_tail_enqueue function. When a pfifo_head_drop qdisc is configured with sch->limit == 0, the function's drop logic is skipped, but the enqueue still increments the qdisc's qlen, leading to a mismatch between parent and child qdiscs. This violates the design invariant that a parent qdisc's qlen equals the sum of its children's qlen.

Exploitation

Scenario

An attacker can trigger this by setting up two qdiscs: Qdisc_A (e.g., hfsc or drr) with a graft function, and Qdisc_B (pfifo_head_drop) with limit 0. When a packet is enqueued through Qdisc_A, it calls pfifo_tail_enqueue on Qdisc_B, which increments Qdisc_B's qlen but returns NET_XMIT_CN. Qdisc_A sees the non-success code and does not increment its own qlen, resulting in Qdisc_A's qlen remaining 0 while Qdisc_B's qlen increases.

Impact

This bug can be exploited for user-to-kernel privilege escalation when the vulnerable code path is reachable. The issue affects the Linux kernel and has been addressed in stable releases. Systems using affected versions may be at risk if an unprivileged user can create the described qdisc configuration [1].

Mitigation

The Linux kernel has released patches to fix the issue. Siemens has confirmed that its SIMATIC S7-1500 CPU family (including related ET 200 CPUs and SIPLUS variants) is affected and recommends applying the provided remediations [1]. Users should update to the latest patched kernel versions or apply vendor-specific updates.

References
  1. SSA-082556

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

355

Patches

8
79a955ea4a2e
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.gitvia osv
commit
e40cb34b7f24
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.gitvia osv
commit
b6a079c3b6f9
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.gitvia osv
commit
647cef20e649
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.gitvia osv
commit
78285b53266d
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.gitvia osv
commit
7a9723ec27af
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.gitvia osv
commit
a56a6e8589a9
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.gitvia osv
commit
020ecb76812a
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.gitvia osv
commit

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

11

News mentions

0

No linked articles in our index yet.