CVE-2025-21653

Q: What is the severity of CVE-2025-21653?

CVE-2025-21653 has a CVSS score of 5.5 (MEDIUM). A Linux kernel vulnerability in the net_sched subsystem allows unvalidated right shift operations on 32-bit integers, potentially causing undefined behavior. This affects systems using the cls_flow classifier for traffic control. The vulnerability could lead to kernel instability or denial of service.

5.5 MEDIUM

Denial of Service

📋 TL;DR

A Linux kernel vulnerability in the net_sched subsystem allows unvalidated right shift operations on 32-bit integers, potentially causing undefined behavior. This affects systems using the cls_flow classifier for traffic control. The vulnerability could lead to kernel instability or denial of service.

💻 Affected Systems

Products:

Linux kernel

Versions: Versions before fixes in commit 2011749ca96460386844dfc7e0fde53ebee96f3c and related stable backports

Operating Systems: Linux distributions using vulnerable kernel versions

Default Config Vulnerable: ✅ No

Notes: Only vulnerable when cls_flow classifier is configured via netlink (tc command) with TCA_FLOW_RSHIFT attribute containing large shift values.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic or system crash due to undefined shift behavior, causing denial of service.

🟠

Likely Case

Kernel instability, potential crashes, or unpredictable network behavior when cls_flow classifier processes malformed traffic control rules.

🟢

If Mitigated

Minimal impact if cls_flow classifier is not used or proper input validation is enforced.

🌐 Internet-Facing: MEDIUM - Requires specific network configuration and traffic control rules to be exploitable.

🏢 Internal Only: MEDIUM - Same requirements as internet-facing, but internal attackers could exploit if they have network access.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Exploitation requires ability to configure traffic control rules via netlink (typically requires root or CAP_NET_ADMIN). Found via syzkaller fuzzing.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Fixed in Linux kernel mainline and backported to stable branches (commits listed in references)

Vendor Advisory: https://git.kernel.org/stable/c/2011749ca96460386844dfc7e0fde53ebee96f3c

Restart Required: Yes

Instructions:

1. Update Linux kernel to patched version. 2. Check distribution-specific advisories. 3. Reboot system to load new kernel.

🔧 Temporary Workarounds

Disable cls_flow classifier

linux

Remove or avoid using cls_flow traffic control classifier

tc filter del dev <interface> parent <handle>
Remove cls_flow rules from configuration

🧯 If You Can't Patch

Restrict netlink access to prevent unauthorized traffic control rule modifications
Monitor for unusual traffic control configuration changes

🔍 How to Verify

Check if Vulnerable:

Check kernel version and if cls_flow classifier is configured: uname -r and tc filter show

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version includes fix commit or is newer than patched versions

📡 Detection & Monitoring

Log Indicators:

Kernel logs showing 'shift-out-of-bounds' or UBSAN warnings
System crashes or instability when using traffic control

Network Indicators:

Unusual traffic control rule modifications
Network performance issues after tc configuration changes

SIEM Query:

kernel: *shift-out-of-bounds* OR kernel: *UBSAN* AND cls_flow

📊 Metadata

CVE ID: CVE-2025-21653

CVSS v3 Score: 5.5 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS Score: 0.06% exploit probability (18.9th percentile)

Published: January 19, 2025

Last Updated: November 3, 2025

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Disable cls_flow classifier

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export