CVE-2025-21702

What it actually does

Incorrect qlen accounting in pfifo_tail_enqueue when sch->limit==0 allows a child qdisc to increment its queue length without a matching update in the parent qdisc, violating the parent-child qlen invariant and enabling user-to-kernel privilege escalation when reachable via crafted qdisc hierarchies.

Why it matters to the business

Local attackers can gain elevated privileges on Linux systems, potentially leading to full host compromise, data theft, or persistence in environments running affected kernel versions; high downstream prevalence increases exposure across server and embedded deployments.

How an attack unfolds

An attacker configures a parent qdisc (such as hfsc or drr) with a child pfifo_head_drop qdisc set to limit 0, then enqueues packets through the parent to trigger pfifo_tail_enqueue on the child; this increments only the child's qlen while returning NET_XMIT_CN, creating an inconsistent state that is abused to escalate privileges from user space to kernel.

How to fix it

Upgrade to a fixed kernel containing commit 78285b53266d6d51fa4ff504a23df03852eba84e or apply the AlmaLinux package updates: platform-python, platform-python-debug, platform-python-devel, python3-idle, python3-test, python3-tkinter, and python3-libs to version 3.6.8-56.el8_9.alma.1.

How to confirm the fix worked

Verify the running kernel contains the fix commit or matches the listed AlmaLinux package versions; test qdisc enqueue behavior with limit=0 to confirm qlen consistency between parent and child.

Typical attack path

1. Identify or create a qdisc hierarchy with a parent supporting graft and a child pfifo qdisc configured with limit 0
2. Enqueue packets via the parent qdisc to invoke pfifo_tail_enqueue on the child
3. Trigger the qlen desynchronization without corresponding parent update
4. Exploit the resulting invariant violation to achieve kernel code execution or privilege escalation

How to detect it

Review kernel logs for anomalous NET_XMIT_CN returns from qdisc enqueue paths and inspect active qdisc hierarchies for parent-child qlen mismatches; correlate with process activity creating or modifying traffic control configurations.

What your security team should do

• Prioritize kernel upgrades on all exposed Linux hosts within the next patching cycle
• Audit systems for custom qdisc configurations that could reach the vulnerable path
• Monitor for new exploit code targeting this class of qdisc accounting issues
• Apply defense-in-depth by restricting unprivileged qdisc manipulation where possible