CVE-2025-71066

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The Linux kernel contains a race condition within the ets qdisc change function related to the handling of Quality of Service (QoS) classes. This condition can lead to a Use-After-Free (UAF) issue on struct Qdisc objects. An attacker with the capability to create new user and network namespaces can trigger this issue. The vulnerability occurs because classes may remain in the active list even after their associated qdiscs are freed, potentially allowing for control of RIP (Return-Oriented Programming). The issue is resolved by ensuring that a class is always removed from the active list before its qdisc is deleted.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.