CVE-2025-21647 in Linux
Summary
by MITRE • 01/19/2025
In the Linux kernel, the following vulnerability has been resolved:
sched: sch_cake: add bounds checks to host bulk flow fairness counts
Even though we fixed a logic error in the commit cited below, syzbot still managed to trigger an underflow of the per-host bulk flow counters, leading to an out of bounds memory access.
To avoid any such logic errors causing out of bounds memory accesses, this commit factors out all accesses to the per-host bulk flow counters to a series of helpers that perform bounds-checking before any increments and decrements. This also has the benefit of improving readability by moving the conditional checks for the flow mode into these helpers, instead of having them spread out throughout the code (which was the cause of the original logic error).
As part of this change, the flow quantum calculation is consolidated into a helper function, which means that the dithering applied to the ost load scaling is now applied both in the DRR rotation and when a sparse flow's quantum is first initiated. The only user-visible effect of this is that the maximum packet size that can be sent while a flow stays sparse will now vary with +/- one byte in some cases. This should not make a noticeable difference in practice, and thus it's not worth complicating the code to preserve the old behaviour.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/30/2026
The vulnerability CVE-2025-21647 resides within the Linux kernel's scheduling subsystem, specifically in the sch_cake traffic control qdisc implementation. This issue represents a classic bounds checking failure that could potentially lead to memory corruption and system instability. The vulnerability was initially addressed through a logic error fix, yet syzbot testing revealed that the underlying protection mechanisms were insufficient to prevent all possible scenarios of counter underflow. The sch_cake qdisc is designed to provide quality of service guarantees by managing network traffic flow fairness, making this a critical component for network security and system stability.
The technical flaw manifests as an insufficient bounds check on per-host bulk flow counters within the kernel's traffic control implementation. When these counters experience underflow conditions, the system accesses memory locations beyond the allocated bounds, creating a potential vector for memory corruption attacks. This type of vulnerability maps directly to CWE-129, which addresses improper bounds checking, and CWE-787, which covers out-of-bounds write operations. The root cause stems from scattered conditional checks throughout the codebase that were not properly consolidated, leading to logic errors that allowed the underflow conditions to persist despite previous fixes.
The operational impact of this vulnerability extends beyond simple memory corruption to potentially affect network service availability and system integrity. Attackers could theoretically exploit this condition to cause denial of service through memory corruption, potentially leading to system crashes or privilege escalation in scenarios where the memory corruption affects critical kernel data structures. The vulnerability affects systems running Linux kernels with the sch_cake qdisc enabled, particularly those implementing network traffic control policies that utilize bulk flow counting mechanisms. The security implications align with ATT&CK technique T1068, which covers local privilege escalation through kernel exploits, and T1499, covering network denial of service attacks.
The resolution implemented in this patch involves refactoring the codebase to establish dedicated helper functions for all accesses to per-host bulk flow counters. This approach consolidates bounds checking logic into centralized functions, eliminating the scattered conditional checks that previously caused the logic error. The fix also introduces a consolidated flow quantum calculation helper, which ensures consistent application of dithering across different operational contexts. This architectural improvement not only resolves the immediate memory access issue but also enhances code maintainability and reduces the likelihood of similar logic errors in the future. The mitigation strategy follows best practices for kernel security hardening by implementing defensive programming techniques and centralized access control mechanisms. The only observable behavioral change is a minor variation in maximum packet sizes for sparse flows, which is deemed negligible in practical applications and does not compromise the overall security posture or functionality of the network traffic control system.