CVE-2025-21653

What it actually does

Missing validation of TCA_FLOW_RSHIFT netlink attribute allows an out-of-bounds shift exponent on a u32 value in cls_flow.c:329, triggering undefined behavior (UBSAN shift-out-of-bounds) during flow classification.

Why it matters to the business

Systems using the cls_flow classifier with the sfb qdisc or similar traffic-control setups can experience kernel-level denial of service from crafted configuration, increasing operational risk on affected Red Hat JBoss EAP 6 deployments until patched.

How an attack unfolds

An attacker with local privileges crafts a malicious TCA_FLOW_RSHIFT value via netlink and attaches the cls_flow classifier; when packets traverse the qdisc, flow_classify performs the unchecked shift, hitting UBSAN and potentially crashing the kernel worker thread.

How to fix it

Update all listed JBoss EAP 6 packages on RHEL 7 to version 7.5.11-1.Final_redhat_1.1.ep6.el7 or later; rebuild and redeploy any dependent applications after the package upgrade.

How to confirm the fix worked

After upgrade, verify package versions match the fixed releases, confirm absence of the UBSAN shift warning in dmesg under synthetic tc load, and run regression tests that exercise cls_flow and sfb qdiscs.

Typical attack path

1. Obtain local user or container access on a vulnerable kernel
2. Use netlink sockets or tc(8) to create a cls_flow filter with an excessively large TCA_FLOW_RSHIFT value
3. Attach the filter to a qdisc such as sfb that invokes tcf_classify
4. Trigger packet transmission through the affected path (e.g., geneve tunnel or IPv4 output)
5. Cause shift-out-of-bounds during classification leading to UBSAN report or kernel instability

How to detect it

Search kernel logs (dmesg, journalctl) for UBSAN shift-out-of-bounds entries mentioning cls_flow.c or flow_classify; inspect audit logs for unusual netlink messages creating cls_flow filters; correlate with tc command history on systems running sfb or geneve.

• UBSAN: shift-out-of-bounds in net/sched/cls_flow.c:329
• shift exponent .* is too large for 32-bit type 'u32'
• flow_classify+0x24d5/0x25b0 net/sched/cls_flow.c

What your security team should do

• Prioritize patching all affected JBoss EAP 6 instances on RHEL 7 within the next maintenance window
• Restrict unprivileged use of tc and netlink traffic-control commands via SELinux or capabilities where feasible
• Monitor kernel logs for UBSAN shift-out-of-bounds messages related to cls_flow
• Review and minimize use of cls_flow classifier in production qdisc configurations