PT-2025-6065 · Linux+7 · Linux Kernel+7
Haowei Yan
·
Published
2025-01-11
·
Updated
2026-01-29
·
CVE-2025-21692
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions prior to 6.12.6
Description
The issue is related to an Out-Of-Bounds indexing vulnerability in the
ets class from arg() function when passed a clid of 0. This overflow may cause local privilege escalation. The vulnerability was discovered by Haowei Yan.Technical details about exploitation include:
- The
ets class from arg()function is vulnerable to Out-Of-Bounds indexing. - The
clidvariable is used in this function and passing a value of 0 can cause the overflow. - The
tc ctl tclass()andets class change()functions are also involved in the call trace. - The
/net/sched/sch ets.cfile is where the vulnerability is located.
Recommendations
To resolve the issue, update the Linux kernel to a version that includes the fix for the
ets class from arg() Out-Of-Bounds indexing vulnerability.
As a temporary workaround, consider restricting access to the vulnerable ets class from arg() function until a patch is available.Exploit
Fix
LPE
RCE
Out of bounds Read
Improper Validation of Array Index
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Debian
Linuxmint
Linux Kernel
Red Os
Suse
Ubuntu