CVE-2025-71075
Published: 13 January 2026
Summary
CVE-2025-71075 is a high-severity Use After Free (CWE-416) vulnerability in Linux Linux Kernel. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 1.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and CM-6 (Configuration Settings).
Deeper analysis
CVE-2025-71075 is a use-after-free vulnerability in the Linux kernel's aic94xx SCSI driver. The issue arises in the asd_pci_remove() function, which fails to synchronize with pending tasklets before freeing the asd_ha structure during device removal. This can lead to a race condition when device removal is triggered via hot-unplug or module unload. The vulnerability is rated with a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and is associated with CWE-416 (Use After Free).
A local attacker with low privileges can exploit this vulnerability by triggering a device removal event, such as hot-unplugging a device or unloading the module, while racing against unsynchronized tasklets. Successful exploitation of the use-after-free could allow the attacker to achieve high-impact confidentiality, integrity, and availability violations, potentially leading to arbitrary code execution, data corruption, or system crashes.
The provided kernel stable commit references detail the mitigation, which involves adding a call to tasklet_kill() in asd_pci_remove() prior to freeing the asd_ha structure. This ensures all scheduled tasklets complete before cleanup, preventing the race condition. Security practitioners should apply these patches to affected Linux kernel versions supporting the aic94xx driver.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-2283
Vulnerability details
In the Linux kernel, the following vulnerability has been resolved: scsi: aic94xx: fix use-after-free in device removal path The asd_pci_remove() function fails to synchronize with pending tasklets before freeing the asd_ha structure, leading to a potential use-after-free vulnerability. When a…
more
device removal is triggered (via hot-unplug or module unload), race condition can occur. The fix adds tasklet_kill() before freeing the asd_ha structure, ensuring all scheduled tasklets complete before cleanup proceeds.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local use-after-free in kernel driver enables privilege escalation via device removal race to achieve arbitrary code execution.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires organizations to identify, prioritize, and apply patches to remediate the use-after-free vulnerability in the Linux kernel's aic94xx SCSI driver during device removal.
Mandates secure configuration settings for the kernel, such as blacklisting the vulnerable aic94xx driver when not required for hardware, preventing its loading and potential exploitation.
Implements runtime memory protections like ASLR and DEP that hinder exploitation of the use-after-free race condition in the asd_pci_remove() function.