CVE-2025-71066 is a local privilege escalation vulnerability in the Linux Kernel related to a race condition in the ETS scheduler's handling of Qdisc objects. The vulnerability stems from a lack of proper locking during operations on these objects, which can be exploited by an attacker who already has the ability to execute high-privileged code on the system. Successful exploitation allows escalation of privileges and arbitrary code execution within the kernel. The Zero Day Initiative assigned a CVSS score of 7.5 (AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H). Linux has released an update to fix this issue, as documented in the vendor advisory and linked kernel patch mailing list post.

This vulnerability enables local attackers with existing high-privilege code execution to escalate their privileges further and execute arbitrary code in kernel context. This can lead to complete system compromise, including confidentiality, integrity, and availability impacts. The high CVSS score reflects the significant impact on affected systems if exploited.

Linux has issued an official update to correct this vulnerability. Applying the vendor-provided patch or updated kernel version is the recommended remediation. Since this is a local privilege escalation requiring prior high-privilege code execution, ensuring systems are updated will prevent exploitation. No additional mitigations are specified in the advisory.