CVE-2025-21971

A flaw was found in the Linux kernel's network traffic scheduling subsystem. A local user with network administration privileges can cause a Denial of Service (DoS) by configuring traffic control classes with a reserved root identifier. This improper configuration disrupts packet backlog tracking during queue traversals and can trigger a system crash.

This vulnerability is rated as Moderate because exploitation requires local access and elevated network administration privileges (CAP_NET_ADMIN) to configure traffic control classes, which restricts the attack vector. An attacker capable of defining queue discipline classes can trigger improper backlog accounting and crash the system, resulting in a denial of service. The vulnerability cannot be leveraged for data exposure or code execution, and standard unprivileged users cannot manipulate traffic scheduler settings in default environments.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.