Executive brief
A vulnerability in the Linux kernel's networking subsystem could allow a local user with specific privileges to crash the system or potentially execute unauthorized code. The issue occurs in the Enhanced Transmission Selection (ETS) scheduler, which manages how network traffic is prioritized. By exploiting a timing flaw during network configuration changes, an attacker could cause the system to access memory that has already been freed, leading to instability or a security breach.
Technical details
A race condition exists between the `ets_qdisc_dequeue` and `ets_qdisc_change` functions in `net/sched/sch_ets.c`. The root cause is that `ets_qdisc_change` releases the `sch_tree_lock` before it finishes cleaning up deleted classes, allowing a concurrent dequeue operation to access a class whose associated Qdisc has already been freed via `qdisc_put`. This results in a use-after-free (UAF) on the `struct Qdisc` object. To trigger the bug, an attacker requires the `CAP_NET_ADMIN` capability, typically achieved by creating new user and network namespaces. The vulnerability has been patched by ensuring classes are removed from the active list before their associated Qdiscs are freed.
Affected products
- Linux Linux Kernel All versions prior to the fix in January 2026
Timeline
- 2025-11-28: other: Patch authored
- 2026-01-13: advisory: CVE-2025-71066 disclosed
- 2026-01-19: patched: Fix committed to stable trees
References
- https://git.kernel.org/stable/c/062d5d544e564473450d72e6af83077c2b2ff7c3
- https://git.kernel.org/stable/c/06bfb66a7c8b45e3fed01351a4b087410ae5ef39
- https://git.kernel.org/stable/c/45466141da3c98a0c5fa88be0bc14b4b6a4bd75c
- https://git.kernel.org/stable/c/9987cda315c08f63a02423fa2f9a1f6602c861a0
- https://git.kernel.org/stable/c/a75d617a4ef08682f5cfaadc01d5141c87e019c9
- https://git.kernel.org/stable/c/c7f6e7cc14df72b997258216e99d897d2df0dbbd
- https://git.kernel.org/stable/c/ce052b9402e461a9aded599f5b47e76bc727f7de