From Simple Bug to RCE: A Flaw (CVE-2025-21692) in the Linux Kernel, PoC Published

A vulnerability tracked as CVE-2025-21692 has been disclosed in the Linux kernel, affecting the Enhanced Transmission Selection (ETS) qdisc, with a PoC and a deep technical write‑up published. The flaw stems from a logic error in the ets_class_from_arg function, where improper validation of the class identifier can lead to an out‑of‑bounds access, enabling memory corruption and the potential to overwrite kernel pointers.

According to Volticks, the bug can be triggered by an arg class id of 0, with a risk of underflow, and attackers could craft inputs to read or write beyond bounds, paving the way for exploitation. The researcher described moving from a memory corruption primitive to a reliable exploit by corrupting ETS class structures, which can lead to a write‑what‑where primitive and ultimately to code execution by manipulating kernel memory via a crafted PF_PACKET socket.

A proof‑of‑concept exploit is available on Github, and the write‑up details how a crafted ROP chain can achieve privilege escalation and arbitrary code execution in the kernel.