Baitaphish
Security intelligence
SearchLatest briefing
CVE Explorer

CVE-2025-71066

In the Linux kernel, the following vulnerability has been resolved: net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change zdi-disclosures@trendmicro.com says: The vulnerability is a race condition between `ets_qdisc_dequeue` and `ets_qdisc_change`. It leads to UAF on `struct Qdisc` object. Attacker requires the capability to create new user and network namespace in order to trigger the bug. See my additional commentary at the end of the analysis. Analysis:
Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:213d64036e8d9136606e60f88d1a6987416b031bd754238a6fea1684c48099ad
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
2

Preserved source conflicts

No provider value was silently selected as the winner.

affected · 2 assertions

{"defaultStatus":"affected","product":"Linux","programFiles":["net/sched/sch_ets.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.16"},{"lessThan":"5.16","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.248","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.198","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.160","versionType":"semver"},{"lessThanO…

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:c3aa842eecfbbc7b459ad76c05b346fb17177170b73c4816c1839e2c227db240 · sha256:4a1b7c7007a48e62… · /containers/cna/affected/1

{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/sched/sch_ets.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"062d5d544e564473450d72e6af83077c2b2ff7c3","status":"affected","version":"ae2659d2c670252759ee9c823c4e039c0e05a6f2","versionType":"git"},{"lessThan":"c7f6e7cc14df72b997258216e99d897d2df0dbbd","status":"affected","version":"e25bdbc7e951ae5728fee1f4c09485df113d013c","versionType":"git"},{"lessThan":"a75d617a4ef08682f5cfaadc01d5141c87e019c9","status":"affected","version":"de6d25924c2a8c2988c6a38599…

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:c3aa842eecfbbc7b459ad76c05b346fb17177170b73c4816c1839e2c227db240 · sha256:4a1b7c7007a48e62… · /containers/cna/affected/0
cvss · 2 assertions

{"metric":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"metric_type":"cvssV3_1"}

  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:c3aa842eecfbbc7b459ad76c05b346fb17177170b73c4816c1839e2c227db240 · sha256:4a1b7c7007a48e62… · /containers/cna/metrics/0/cvssV3_1

{"metric":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"metric_type":"cvssV3_1"}

  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:c3aa842eecfbbc7b459ad76c05b346fb17177170b73c4816c1839e2c227db240 · sha256:4a1b7c7007a48e62… · /containers/adp/0/metrics/0/cvssV3_1

Affected products and versions

2 source assertions
{"defaultStatus":"affected","product":"Linux","programFiles":["net/sched/sch_ets.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.16"},{"lessThan":"5.16","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.248","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.198","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.160","versionType":"semver"},{"lessThanO…
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:c3aa842eecfbbc7b459ad76c05b346fb17177170b73c4816c1839e2c227db240 · sha256:4a1b7c7007a48e62… · /containers/cna/affected/1
{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/sched/sch_ets.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"062d5d544e564473450d72e6af83077c2b2ff7c3","status":"affected","version":"ae2659d2c670252759ee9c823c4e039c0e05a6f2","versionType":"git"},{"lessThan":"c7f6e7cc14df72b997258216e99d897d2df0dbbd","status":"affected","version":"e25bdbc7e951ae5728fee1f4c09485df113d013c","versionType":"git"},{"lessThan":"a75d617a4ef08682f5cfaadc01d5141c87e019c9","status":"affected","version":"de6d25924c2a8c2988c6a38599…
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:c3aa842eecfbbc7b459ad76c05b346fb17177170b73c4816c1839e2c227db240 · sha256:4a1b7c7007a48e62… · /containers/cna/affected/0

Provider-owned CVSS observations

2 source assertions
{"metric":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"metric_type":"cvssV3_1"}
  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:c3aa842eecfbbc7b459ad76c05b346fb17177170b73c4816c1839e2c227db240 · sha256:4a1b7c7007a48e62… · /containers/cna/metrics/0/cvssV3_1
{"metric":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"metric_type":"cvssV3_1"}
  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:c3aa842eecfbbc7b459ad76c05b346fb17177170b73c4816c1839e2c227db240 · sha256:4a1b7c7007a48e62… · /containers/adp/0/metrics/0/cvssV3_1

CWE assertions

1 source assertion
{"cweId":"CWE-362","description":"CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')","lang":"en","type":"CWE"}
  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:c3aa842eecfbbc7b459ad76c05b346fb17177170b73c4816c1839e2c227db240 · sha256:4a1b7c7007a48e62… · /containers/adp/0/problemTypes/0/descriptions/0

Source references

7 source assertions
{"url":"https://git.kernel.org/stable/c/062d5d544e564473450d72e6af83077c2b2ff7c3"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:c3aa842eecfbbc7b459ad76c05b346fb17177170b73c4816c1839e2c227db240 · sha256:4a1b7c7007a48e62… · /containers/cna/references/0
{"url":"https://git.kernel.org/stable/c/06bfb66a7c8b45e3fed01351a4b087410ae5ef39"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:c3aa842eecfbbc7b459ad76c05b346fb17177170b73c4816c1839e2c227db240 · sha256:4a1b7c7007a48e62… · /containers/cna/references/4
{"url":"https://git.kernel.org/stable/c/45466141da3c98a0c5fa88be0bc14b4b6a4bd75c"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:c3aa842eecfbbc7b459ad76c05b346fb17177170b73c4816c1839e2c227db240 · sha256:4a1b7c7007a48e62… · /containers/cna/references/5
{"url":"https://git.kernel.org/stable/c/9987cda315c08f63a02423fa2f9a1f6602c861a0"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:c3aa842eecfbbc7b459ad76c05b346fb17177170b73c4816c1839e2c227db240 · sha256:4a1b7c7007a48e62… · /containers/cna/references/3
{"url":"https://git.kernel.org/stable/c/a75d617a4ef08682f5cfaadc01d5141c87e019c9"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:c3aa842eecfbbc7b459ad76c05b346fb17177170b73c4816c1839e2c227db240 · sha256:4a1b7c7007a48e62… · /containers/cna/references/2
{"url":"https://git.kernel.org/stable/c/c7f6e7cc14df72b997258216e99d897d2df0dbbd"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:c3aa842eecfbbc7b459ad76c05b346fb17177170b73c4816c1839e2c227db240 · sha256:4a1b7c7007a48e62… · /containers/cna/references/1
{"url":"https://git.kernel.org/stable/c/ce052b9402e461a9aded599f5b47e76bc727f7de"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:c3aa842eecfbbc7b459ad76c05b346fb17177170b73c4816c1839e2c227db240 · sha256:4a1b7c7007a48e62… · /containers/cna/references/6

Attribution and limitations

  • CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer