CVE-2025-21703
Published: 18 February 2025
Summary
CVE-2025-21703 is a high-severity Use After Free (CWE-416) vulnerability in Linux Linux Kernel. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 3.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-21703 is a Use-After-Free (UAF) vulnerability in the Linux kernel's netem (network emulator) component, stemming from a failure to update sch->q.qlen before calling qdisc_tree_reduce_backlog(). This issue affects queueing discipline (qdisc) handling, where qdisc_tree_reduce_backlog() only notifies the parent qdisc if the child becomes empty. Without prior backlog reduction in the child, notifications like cops->qlen_notify() are missed, leading to UAF in scenarios such as Deficit Round Robin (DRR), which relies on qlen_notify() for its active list maintenance. The vulnerability carries a CVSS v3.1 base score of 7.8 and is classified under CWE-416.
A local attacker with low privileges (PR:L) can exploit this vulnerability with low complexity (AC:L) and no user interaction (UI:N). Successful exploitation grants high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H) within the unchanged security scope (S:U), potentially allowing arbitrary code execution, data corruption, or system crashes through manipulated network queueing operations in netem and related qdiscs like DRR.
Mitigation involves applying kernel patches from the referenced stable commits, such as https://git.kernel.org/stable/c/1f8e3f4a4b8b90ad274dfbc66fc7d55cb582f4d5 and others, which ensure sch->q.qlen is updated before qdisc_tree_reduce_backlog() to properly trigger parent notifications and prevent the UAF. Security practitioners should update affected Linux kernels to versions incorporating these fixes.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-4525
Vulnerability details
In the Linux kernel, the following vulnerability has been resolved: netem: Update sch->q.qlen before qdisc_tree_reduce_backlog() qdisc_tree_reduce_backlog() notifies parent qdisc only if child qdisc becomes empty, therefore we need to reduce the backlog of the child qdisc before calling it. Otherwise…
more
it would miss the opportunity to call cops->qlen_notify(), in the case of DRR, it resulted in UAF since DRR uses ->qlen_notify() to maintain its active list.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local kernel UAF in netem/qdisc handling allows low-privileged attacker to trigger arbitrary code execution or crashes, directly enabling privilege escalation via exploitation of the vulnerability.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mandates timely remediation of the specific kernel flaw causing the UAF in netem qdisc by applying patches that update sch->q.qlen before qdisc_tree_reduce_backlog().
Enables identification of vulnerable Linux kernel versions affected by CVE-2025-21703 through automated vulnerability scanning, triggering remediation.
Implements kernel memory protections such as KASLR, SMEP, and SMAP to increase the difficulty of exploiting the UAF even in unpatched systems.