CVE-2025-71074
kernel: Linux kernel functionfs: Use-After-Free vulnerability due to open/removal races
Severity
ImportantRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · January 13, 2026
Updated · August 21, 2026
Description
A flaw was found in the Linux kernel's functionfs (Filesystem in Userspace for USB functions). A race condition exists between the opening and removal of dynamic functionfs files. A local user could exploit this timing issue, where a file might be freed while another operation attempts to use it. This Use-After-Free (UAF) vulnerability could lead to a system crash or other unpredictable behavior.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-825 · Expired Pointer Dereference