CVE-2025-71066: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-71066 is a use-after-free (UAF) vulnerability in the Linux kernel's net/sched Enhanced Transmission Selection (ETS) traffic scheduler subsystem. It was published on January 13, 2026, and affects multiple Linux kernel versions across major distributions including Debian, Ubuntu, SUSE, and Oracle Linux. The flaw was reported by Trend Micro's Zero Day Initiative (zdi-disclosures@trendmicro.com) and stems from a race condition between the ets_qdisc_dequeue and ets_qdisc_change functions. It carries a CVSS v3.1 base score of 7.5 (High) (Feedly, ZDI Advisory).

The root cause is a race condition (CWE-362) in the ets_qdisc_change function, which fails to always remove a class from the active list before deleting and freeing its associated struct Qdisc object. Specifically, when ets_qdisc_change reduces the number of bands (nbands < oldbands) or changes the number of strict-priority queues (nstrict), it may free qdisc objects while ets_qdisc_dequeue is concurrently iterating over the active list, resulting in a use-after-free on the struct Qdisc object. The sch_tree_lock is intended to prevent this race, but the ordering of list removal and qdisc purge operations was insufficient. Exploitation requires the ability to create new user and network namespaces, which is a prerequisite for manipulating the ETS qdisc configuration (Feedly, ZDI Advisory).

Successful exploitation can result in arbitrary code execution with kernel privileges, enabling complete system compromise including full confidentiality, integrity, and availability impact with a changed scope (affecting resources beyond the vulnerable component). An attacker who achieves kernel-level code execution can read or modify any data on the system, install persistent backdoors, disable security controls, or cause a denial of service via kernel crash. The vulnerability's scope extends system-wide, making lateral movement within a compromised host trivial (Feedly, ZDI Advisory).

1. Gain local access: Obtain a local user account on the target Linux system, or compromise an unprivileged container with user namespace creation enabled.
2. Create user and network namespaces: Use unshare -Urn or equivalent to create a new user namespace and network namespace, granting the ability to configure network qdiscs without root privileges on the host.
3. Set up ETS qdisc: Use tc (traffic control) commands to attach an ETS qdisc to a virtual network interface within the namespace, configuring multiple bands and strict-priority queues (e.g., tc qdisc add dev lo root ets bands 4 strict 2).
4. Trigger the race condition: Concurrently run two threads — one repeatedly calling ets_qdisc_change to reduce the number of bands/strict queues (causing qdisc objects to be freed), and another triggering packet dequeue operations via ets_qdisc_dequeue — to win the race window between list removal and memory free.
5. Achieve use-after-free: When the race is won, ets_qdisc_dequeue accesses the freed struct Qdisc object, allowing controlled memory corruption.
6. Escalate privileges: Leverage the UAF primitive with kernel heap manipulation techniques (e.g., heap spray, object reuse) to overwrite kernel structures and achieve arbitrary kernel code execution, escalating to root (ZDI Advisory, Feedly).

• Logs: Kernel oops or BUG messages in /var/log/kern.log or dmesg referencing ets_qdisc_dequeue, ets_qdisc_change, or use-after-free in net/sched/sch_ets.c; KASAN (Kernel Address Sanitizer) reports indicating UAF in the ETS scheduler.
• Process: Unexpected processes calling unshare with -Urn flags or creating network namespaces; unusual tc (traffic control) commands modifying ETS qdiscs on loopback or virtual interfaces.
• Network: Unusual manipulation of traffic control qdiscs on network interfaces, particularly rapid repeated changes to ETS band/strict queue configurations detectable via tc qdisc show.
• File System: Presence of exploit binaries or scripts referencing ets_qdisc, SCHED_ETS, or namespace manipulation in temporary directories (/tmp, /dev/shm).

Apply the upstream Linux kernel patch that modifies ets_qdisc_change to always remove a class from the active list before deleting and freeing its associated qdisc — patches are available at kernel.org stable commits (e.g., 06bfb66a7c8b, 062d5d544e56, 9987cda315c0, 45466141da3c). Distribution-specific updates have been released by Debian (linux 6.1.162-1, linux 5.10.249-1), Ubuntu (USN-8177-1, USN-8177-2, USN-8183-1, USN-8183-2, USN-8245-1, USN-8257-1), SUSE (SUSE-SU-2026:1686-1, 1698-1, 1708-1, 1725-1, 1735-1, 1770-1, 1776-1), and openSUSE. As a workaround where patching is not immediately possible, restrict the ability to create user and network namespaces by setting kernel.unprivileged_userns_clone=0 (on supported distributions) or user.max_user_namespaces=0 via sysctl (Feedly, Ubuntu Advisory, SUSE Advisory).

The vulnerability was disclosed by Trend Micro's Zero Day Initiative, which published a detailed advisory (ZDI-26-289) on April 15, 2026, including a technical analysis of the race condition (ZDI Advisory). SystemTek published a blog post specifically covering this CVE as a Linux kernel ETS scheduler race condition local privilege escalation vulnerability (SystemTek Blog). Multiple Linux distributions responded promptly with security advisories and kernel updates across Debian, Ubuntu, SUSE, and Oracle Linux, indicating broad industry recognition of the severity.