CVE-2025-71066

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change

[email protected] says:

The vulnerability is a race condition between `ets_qdisc_dequeue` and

`ets_qdisc_change`. It leads to UAF on `struct Qdisc` object.

Attacker requires the capability to create new user and network namespace

in order to trigger the bug.

See my additional commentary at the end of the analysis.

Analysis:

static int ets_qdisc_change(struct Qdisc *sch, struct nlattr *opt,

struct netlink_ext_ack *extack)

{

...

// (1) this lock is preventing .change handler (`ets_qdisc_change`)

//to race with .dequeue handler (`ets_qdisc_dequeue`)

sch_tree_lock(sch);

for (i = nbands; i < oldbands; i++) {

if (i >= q->nstrict && q->classes[i].qdisc->q.qlen)

list_del_init(&q->classes[i].alist);

qdisc_purge_queue(q->c

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References