CVE-2025-71074: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-71074 is a race condition (use-after-free) vulnerability in the Linux kernel's FunctionFS (functionfs) subsystem, specifically in the ffs_epfile_open() function. It affects Linux kernel versions from 2.6.35.1 up to (excluding) 6.19, as well as 6.19-rc1 through 6.19-rc8. The vulnerability was published on January 13, 2026, with a patch analysis completed by NIST on March 25, 2026. It carries a CVSS v3.1 base score of 4.7 (Medium) (Feedly, kernel.org patch).

The vulnerability is classified as CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization / Race Condition). The root cause is the misuse of ffs->opened atomic counter: atomic_dec_and_test() and atomic_add_return() are used inconsistently, allowing a race window where ffs_epfile_open() can proceed while a concurrent removal thread has already freed the associated endpoint file object. If the open operation succeeds before incrementing the reference count, file->private_data ends up pointing to a freed object, resulting in a use-after-free (UAF) condition on any subsequent read() or write() call. Exploitation requires local access with low privileges and high attack complexity due to the timing-dependent nature of the race. The fix serializes openers via ffs->mutex, uses atomic_inc_not_zero() to safely check the open count, and marks removed inodes by clearing ->i_private during simple_recursive_removal() (Feedly, kernel.org patch).

Successful exploitation of this vulnerability can cause a denial of service (system crash or kernel panic) by triggering a use-after-free condition in the FunctionFS subsystem when a process reads from or writes to a file descriptor whose underlying object has been freed. The CVSS assessment indicates high availability impact with no confidentiality or integrity impact, meaning the primary risk is system instability rather than data exfiltration. The vulnerability is limited in scope to the local system and does not provide a direct path for privilege escalation or lateral movement based on currently available information (Feedly).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2025-71074. The EPSS score is extremely low at approximately 0.018%, reflecting a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access, low privileges, and precise timing to win the race condition, making opportunistic exploitation unlikely (Feedly).

The vulnerability is patched in the Linux kernel stable tree via commit e5bf5ee266633cb18fff6f98f0b7d59a62819eee, which is included in kernel version 6.19-rc1 and later stable releases (patch version 6.18.3 per ENISA data). Users should update to Linux kernel 6.19 or a patched stable release as soon as available from their distribution vendor. Distributions such as Debian and those tracked by the Yocto Project have been notified and are expected to backport the fix. As a workaround, restricting local user access to FunctionFS endpoints can reduce exposure until a patch is applied (kernel.org patch, Feedly).