CVE-2025-21647

What it actually does

Underflow of per-host bulk flow counters in sch_cake qdisc enables out-of-bounds memory access when logic errors bypass prior checks during flow accounting and DRR rotation.

Why it matters to the business

Local attackers on affected Linux systems can trigger kernel memory corruption, leading to crashes, denial of service, or potential escalation of privileges; widespread exposure in networking stacks increases operational risk until kernels are updated.

How an attack unfolds

An attacker with local access crafts network traffic or uses fuzzing techniques to exercise sch_cake host bulk flow fairness paths, causing per-host counters to underflow; the resulting unchecked decrement leads to an out-of-bounds read or write during flow quantum calculations or sparse flow handling.

How to fix it

Upgrade to a fixed kernel version containing commit 44fe1efb4961c1a5ccab16bb579dfc6b308ad58b or later (for example Linux 5.4.291 or equivalent stable trees); Red Hat users should apply the listed errata for qemu-kvm-rhev and libcacard packages at versions 10:2.3.0-31.el7_2.21 or newer; rebuild and reboot with the patched kernel, then verify the sch_cake helpers are present.

How to confirm the fix worked

Confirm the running kernel contains the bounds-checking helper functions for bulk flow counters; inspect /proc/config.gz or kernel source for the consolidated flow quantum calculation and explicit bounds checks before increment/decrement operations.

Typical attack path

1. Obtain local code execution or shell access on target
2. Configure or attach a sch_cake qdisc to a network interface
3. Generate traffic patterns that trigger repeated flow creation and destruction to induce counter underflow
4. Trigger out-of-bounds memory access via the faulty decrement path
5. Achieve kernel panic, information leak, or arbitrary read/write

How to detect it

Review kernel logs (dmesg, /var/log/kern.log) for oops or warning messages referencing sch_cake bulk flow counters or out-of-bounds accesses; correlate with processes attaching qdiscs via tc; look for unusual local traffic generation preceding crashes.

What your security team should do

• Prioritize kernel updates on all systems using sch_cake or fair queuing disciplines
• Apply the exact fixed versions listed for each distribution (5.4.291, commit 44fe1efb4961, or Red Hat package 10:2.3.0-31.el7_2.21)
• Restrict unprivileged local access until patches are deployed
• Monitor for kernel oops or panic logs related to sch_cake after upgrade