Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2025-71066

25
FAUCET Score

CVE-2025-71066 is a Use-After-Free (UAF) vulnerability in the Linux kernel's net/sched: ets component, specifically a race condition between ets_qdisc_dequeue and ets_qdisc_change functions. This flaw allows an attacker with the capability to create new user and network namespaces to trigger a UAF on a struct Qdisc object, potentially leading to arbitrary code execution. The vulnerability has a FAUCET Risk Score of 7/100, indicating a relatively low severity despite the potential for UAF. There is no public exploit code available, it is not listed in the KEV catalog, and there is limited community discussion and media coverage, suggesting it is not actively exploited in the wild.

Impacted Technologies

VendorProductVersion(s)CPE
>= 5.10.83, < 5.10.248CPE match
cpe:2.3:a:linux:linux_kernel:*:*:*:*:*:*:*:*
>= 5.15.6, < 5.15.198CPE match
cpe:2.3:a:linux:linux_kernel:*:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.1

7.5HIGH

CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Attack Vector
LOCAL
Attack Complexity
HIGH
Privileges Required
HIGH
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
Exploitability Score
0.8
Impact Score
6.0
CvssVersion
3.1

Exploit Intelligence

EPSS Score
0.15%
Probability of exploitation in next 30 days
EPSS Percentile
4.7%
Percentile rank of EPSS score among Peer Group
As of 2026-07-27
Model: v2026.06.15
This CVE's current EPSS score of 0.0015 is in the 31st percentile among its peer group of 160 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.3 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.

Media Mentions

The average CVE in this peer group has 0.2 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (79)

microsoftpatch availablevia msrc
Product: azl3 kernel 6.6.119.3-3 on Azure Linux 3.0Fixed in: 6.6.121.1-1
microsoftpatch availablevia msrc
Product: 20823-17084Fixed in: 6.6.121.1-1
ubuntupatch availablevia ubuntu_usn
Product: linux-oracle (noble)Fixed in: 6.8.0-1049.50
ubuntupatch availablevia ubuntu_usn
Product: linux-aws-6.17 (noble)Fixed in: 6.17.0-1012.12~24.04.1
ubuntupatch availablevia ubuntu_usn
Product: linux-hwe-6.17 (noble)Fixed in: 6.17.0-22.22~24.04.1
ubuntupatch availablevia ubuntu_usn
Product: linux-oracle-6.17 (noble)Fixed in: 6.17.0-1011.11~24.04.1
ubuntupatch availablevia ubuntu_usn
Product: linux-aws (questing)Fixed in: 6.17.0-1012.12
ubuntupatch availablevia ubuntu_usn
Product: linux-oracle (questing)Fixed in: 6.17.0-1011.11
ubuntupatch availablevia ubuntu_usn
Product: linux-nvidia-tegra (noble)Fixed in: 6.8.0-1022.22
ubuntupatch availablevia ubuntu_usn
Product: linux-aws-fips (jammy)Fixed in: 5.15.0-1103.110+fips1
ubuntupatch availablevia ubuntu_usn
Product: linux-fips (jammy)Fixed in: 5.15.0-173.183+fips1
ubuntupatch availablevia ubuntu_usn
Product: linux-gcp-fips (jammy)Fixed in: 5.15.0-1103.112+fips1
ubuntupatch availablevia ubuntu_usn
Product: linux-nvidia-lowlatency (noble)Fixed in: 6.8.0-1051.54.1
ubuntupatch availablevia ubuntu_usn
Product: linux-ibm-5.15 (focal)Fixed in: 5.15.0-1097.100~20.04.1
ubuntupatch availablevia ubuntu_usn
Product: linux-nvidia-tegra-5.15 (focal)Fixed in: 5.15.0-1055.55~20.04.1
ubuntupatch availablevia ubuntu_usn
Product: linux (jammy)Fixed in: 5.15.0-173.183
ubuntupatch availablevia ubuntu_usn
Product: linux-aws (jammy)Fixed in: 5.15.0-1103.110
ubuntupatch availablevia ubuntu_usn
Product: linux-gcp (jammy)Fixed in: 5.15.0-1103.112
ubuntupatch availablevia ubuntu_usn
Product: linux-gkeop (jammy)Fixed in: 5.15.0-1086.94
ubuntupatch availablevia ubuntu_usn
Product: linux-ibm (jammy)Fixed in: 5.15.0-1097.100
ubuntupatch availablevia ubuntu_usn
Product: linux-intel-iotg (jammy)Fixed in: 5.15.0-1098.104
ubuntupatch availablevia ubuntu_usn
Product: linux-kvm (jammy)Fixed in: 5.15.0-1095.100
ubuntupatch availablevia ubuntu_usn
Product: linux-lowlatency (jammy)Fixed in: 5.15.0-173.183
ubuntupatch availablevia ubuntu_usn
Product: linux-nvidia (jammy)Fixed in: 5.15.0-1098.99
ubuntupatch availablevia ubuntu_usn
Product: linux-nvidia-tegra (jammy)Fixed in: 5.15.0-1055.55
ubuntupatch availablevia ubuntu_usn
Product: linux-oracle (jammy)Fixed in: 5.15.0-1100.106
ubuntupatch availablevia ubuntu_usn
Product: linux-xilinx-zynqmp (jammy)Fixed in: 5.15.0-1067.71
ubuntupatch availablevia ubuntu_usn
Product: linux-realtime (jammy)Fixed in: 5.15.0-1102.111
ubuntupatch availablevia ubuntu_usn
Product: linux-aws-5.15 (focal)Fixed in: 5.15.0-1103.110~20.04.1
ubuntupatch availablevia ubuntu_usn
Product: linux-gcp-5.15 (focal)Fixed in: 5.15.0-1103.112~20.04.1
ubuntupatch availablevia ubuntu_usn
Product: linux-hwe-5.15 (focal)Fixed in: 5.15.0-173.183~20.04.1
ubuntupatch availablevia ubuntu_usn
Product: linux-intel-iotg-5.15 (focal)Fixed in: 5.15.0-1098.104~20.04.1
ubuntupatch availablevia ubuntu_usn
Product: linux-lowlatency-hwe-5.15 (focal)Fixed in: 5.15.0-173.183~20.04.1
ubuntupatch availablevia ubuntu_usn
Product: linux-oracle-5.15 (focal)Fixed in: 5.15.0-1100.106~20.04.1
ubuntupatch availablevia ubuntu_usn
Product: linux-gke (jammy)Fixed in: 5.15.0-1099.105
ubuntupatch availablevia ubuntu_usn
Product: linux-nvidia-tegra-igx (jammy)Fixed in: 5.15.0-1044.44
ubuntupatch availablevia ubuntu_usn
Product: linux-intel-iot-realtime (jammy)Fixed in: 5.15.0-1094.96
ubuntupatch availablevia ubuntu_usn
Product: linux-azure-5.15 (focal)Fixed in: 5.15.0-1110.119~20.04.1
ubuntupatch availablevia ubuntu_usn
Product: linux-gcp-6.8 (jammy)Fixed in: 6.8.0-1054.57~22.04.1
ubuntupatch availablevia ubuntu_usn
Product: linux-xilinx (noble)Fixed in: 6.8.0-1029.30
ubuntupatch availablevia ubuntu_usn
Product: linux-azure-fips (noble)Fixed in: 6.8.0-1054.60+fips1
ubuntupatch availablevia ubuntu_usn
Product: linux-azure (noble)Fixed in: 6.8.0-1054.60
ubuntupatch availablevia ubuntu_usn
Product: linux-raspi (questing)Fixed in: 6.17.0-1014.14
ubuntupatch availablevia ubuntu_usn
Product: linux-azure-6.17 (noble)Fixed in: 6.17.0-1013.13~24.04.1
ubuntupatch availablevia ubuntu_usn
Product: linux-oem-6.17 (noble)Fixed in: 6.17.0-1020.20
ubuntupatch availablevia ubuntu_usn
Product: linux-azure (questing)Fixed in: 6.17.0-1013.13
ubuntupatch availablevia ubuntu_usn
Product: linux-raspi (jammy)Fixed in: 5.15.0-1097.100
ubuntupatch availablevia ubuntu_usn
Product: linux-azure-fips (jammy)Fixed in: 5.15.0-1109.118+fips1
ubuntupatch availablevia ubuntu_usn
Product: linux-azure (jammy)Fixed in: 5.15.0-1109.118
ubuntupatch availablevia ubuntu_usn
Product: linux-aws-6.8 (jammy)Fixed in: 6.8.0-1052.55~22.04.1
ubuntupatch availablevia ubuntu_usn
Product: linux-lowlatency-hwe-6.8 (jammy)Fixed in: 6.8.0-110.110.1~22.04.1
ubuntupatch availablevia ubuntu_usn
Product: linux (noble)Fixed in: 6.8.0-110.110
ubuntupatch availablevia ubuntu_usn
Product: linux-aws (noble)Fixed in: 6.8.0-1052.55
ubuntupatch availablevia ubuntu_usn
Product: linux-gcp (noble)Fixed in: 6.8.0-1054.57
ubuntupatch availablevia ubuntu_usn
Product: linux-gke (noble)Fixed in: 6.8.0-1050.56
ubuntupatch availablevia ubuntu_usn
Product: linux-gkeop (noble)Fixed in: 6.8.0-1037.40
ubuntupatch availablevia ubuntu_usn
Product: linux-ibm (noble)Fixed in: 6.8.0-1051.51
ubuntupatch availablevia ubuntu_usn
Product: linux-lowlatency (noble)Fixed in: 6.8.0-110.110.1
ubuntupatch availablevia ubuntu_usn
Product: linux (questing)Fixed in: 6.17.0-22.22
ubuntupatch availablevia ubuntu_usn
Product: linux-realtime (questing)Fixed in: 6.17.0-1010.11
ubuntupatch availablevia ubuntu_usn
Product: linux-nvidia-6.8 (jammy)Fixed in: 6.8.0-1051.54~22.04.1
ubuntupatch availablevia ubuntu_usn
Product: linux-nvidia (noble)Fixed in: 6.8.0-1051.54
ubuntupatch availablevia ubuntu_usn
Product: linux-aws-fips (noble)Fixed in: 6.8.0-1052.55+fips1
ubuntupatch availablevia ubuntu_usn
Product: linux-fips (noble)Fixed in: 6.8.0-110.110+fips2
ubuntupatch availablevia ubuntu_usn
Product: linux-gcp-fips (noble)Fixed in: 6.8.0-1054.57+fips1
ubuntupatch availablevia ubuntu_usn
Product: linux-realtime-6.8 (jammy)Fixed in: 6.8.1-1047.48~22.04.1
ubuntupatch availablevia ubuntu_usn
Product: linux-realtime (noble)Fixed in: 6.8.1-1047.48
ubuntupatch availablevia ubuntu_usn
Product: linux-gcp-6.17 (noble)Fixed in: 6.17.0-1012.12~24.04.1
ubuntupatch availablevia ubuntu_usn
Product: linux-gcp (questing)Fixed in: 6.17.0-1012.12
ubuntupatch availablevia ubuntu_usn
Product: linux-raspi-realtime (noble)Fixed in: 6.8.0-2042.43
ubuntupatch availablevia ubuntu_usn
Product: linux-oracle-6.8 (jammy)Fixed in: 6.8.0-1049.50~22.04.1
ubuntupatch availablevia ubuntu_usn
Product: linux-hwe-6.8 (jammy)Fixed in: 6.8.0-110.110~22.04.1
ubuntupatch availablevia ubuntu_usn
Product: linux-ibm-6.8 (jammy)Fixed in: 6.8.0-1051.51~22.04.1
ubuntupatch availablevia ubuntu_usn
Product: linux-raspi (noble)Fixed in: 6.8.0-1052.56
redhatno patchvia redhat_api
Product: Red Hat Enterprise Linux 9Fixed in: kernel
redhatno patchvia redhat_api
Product: Red Hat Enterprise Linux 9Fixed in: kernel-rt
redhatno patchvia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: kernel
redhatno patchvia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: kernel-rt
redhatno patchvia redhat_api
Product: Red Hat Enterprise Linux 10Fixed in: kernel

Vendor Advisories (30)

ubuntuUSN-8265-1

Linux kernel (NVIDIA Tegra) vulnerabilities

May 11, 2026
ubuntuUSN-8261-1

Linux kernel (Xilinx) vulnerabilities

May 7, 2026
ubuntuUSN-8260-1

Linux kernel (Azure FIPS) vulnerabilities

May 7, 2026
ubuntuUSN-8258-1

Linux kernel (Azure) vulnerabilities

May 7, 2026
ubuntuUSN-8257-1

Linux kernel (Raspberry Pi) vulnerabilities

May 7, 2026
ubuntuUSN-8245-1

Linux kernel vulnerabilities

May 7, 2026
ubuntuUSN-8243-1

Linux kernel (Azure) vulnerabilities

May 7, 2026
ubuntuUSN-8179-4

Linux kernel (GCP) vulnerabilities

May 7, 2026
ubuntuUSN-8185-2

Linux kernel (Low Latency NVIDIA) vulnerabilities

Apr 28, 2026
ubuntuUSN-8204-1

Linux kernel (Raspberry Pi Real-time) vulnerabilities

Apr 23, 2026
ubuntuUSN-8203-1

Linux kernel (Oracle) vulnerabilities

Apr 23, 2026
ubuntuUSN-8179-3

Linux kernel vulnerabilities

Apr 23, 2026
ubuntuUSN-8183-2

Linux kernel vulnerabilities

Apr 23, 2026
ubuntuUSN-8185-1

Linux kernel (NVIDIA) vulnerabilities

Apr 17, 2026
ubuntuUSN-8179-2

Linux kernel (FIPS) vulnerabilities

Apr 17, 2026
ubuntuUSN-8184-1

Linux kernel (Real-time) vulnerabilities

Apr 17, 2026
ubuntuUSN-8183-1

Linux kernel (GCP) vulnerabilities

Apr 17, 2026
ubuntuUSN-8179-1

Linux kernel vulnerabilities

Apr 16, 2026
ubuntuUSN-8177-1

Linux kernel vulnerabilities

Apr 16, 2026
ubuntuUSN-8163-2

Linux kernel (Azure) vulnerabilities

Apr 13, 2026
ubuntuUSN-8163-1

Linux kernel (Azure FIPS) vulnerabilities

Apr 9, 2026
ubuntuUSN-8141-1

Linux kernel (Raspberry Pi) vulnerabilities

Apr 1, 2026
ubuntuUSN-8096-5

Linux kernel (NVIDIA Tegra IGX) vulnerabilities

Mar 23, 2026
ubuntuUSN-8116-1

Linux kernel (Intel IoTG Real-time) vulnerabilities

Mar 23, 2026
ubuntuUSN-8096-4

Linux kernel (Real-time) vulnerabilities

Mar 17, 2026
ubuntuUSN-8096-3

Linux kernel vulnerabilities

Mar 17, 2026
ubuntuUSN-8096-2

Linux kernel (FIPS) vulnerabilities

Mar 16, 2026
ubuntuUSN-8096-1

Linux kernel vulnerabilities

Mar 16, 2026
microsoft2026-Jan/CVE-2025-71066Critical

net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change

Jan 13, 2026
redhatCVE-2025-71066Moderate

kernel: net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change

Jan 13, 2026

References

git.kernel.org / stable/c/062d5d544e564473450d72e6af83077c2b2ff7c3
git.kernel.org / stable/c/06bfb66a7c8b45e3fed01351a4b087410ae5ef39
git.kernel.org / stable/c/45466141da3c98a0c5fa88be0bc14b4b6a4bd75c
git.kernel.org / stable/c/9987cda315c08f63a02423fa2f9a1f6602c861a0
git.kernel.org / stable/c/a75d617a4ef08682f5cfaadc01d5141c87e019c9
git.kernel.org / stable/c/c7f6e7cc14df72b997258216e99d897d2df0dbbd
git.kernel.org / stable/c/ce052b9402e461a9aded599f5b47e76bc727f7de