CVE-2025-21703

Summary

CVE-2025-21703 is a vulnerability affecting the Linux kernel. It was identified in the netem subsystem where an issue was found with the qdisc (queue disciplinary algorithm) reduction process. Specifically, the update order of the sch->q.qlen variable and the qdisc_tree_reduce_backlog() function call was incorrect. This led to the opportunity for a use-after-free (UAF) condition when the child qdisc became empty and the parent qdisc was not notified, which occurs in the DRR (Deficit Round Robin) scheduling algorithm. To address this issue, the update order has been corrected to ensure the qdisc backlog is reduced prior to notifying the parent qdisc.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.