CVE-2025-21631 — Use After Free in Linux

CWE-416 — Use After Free59 documents6 sources
Severity
7.8HIGHNVD
OSV7.1OSV6.2OSV5.5
EPSS
0.0%
top 94.37%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
LinuxLinux KernelDebian Linux+1 more
Timeline
PublishedJan 19
Latest updateMay 29

Description

In the Linux kernel, the following vulnerability has been resolved: block, bfq: fix waker_bfqq UAF after bfq_split_bfqq() Our syzkaller report a following UAF for v6.6: BUG: KASAN: slab-use-after-free in bfq_init_rq+0x175d/0x17a0 block/bfq-iosched.c:6958 Read of size 8 at addr ffff8881b57147d8 by task fsstress/232726 CPU: 2 PID: 232726 Comm: fsstress Not tainted 6.6.0-g3629d1885222 #39 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x91/0xf0 lib/dump_stack.c:106 print_…

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages6 packages

▶NVDlinux/linux_kernel5.15.168 — 5.15.177+5
▶Debianlinux/linux_kernel< 6.1.128-1+2
▶Ubuntulinux/linux_kernel< 5.15.0-135.146+1
▶CVEListV5linux/linux63a07379fdb6c72450cb05294461c6016b8b7726 — f587c1ac68956c4703857d650d9b1cd7bb2ac4d7+7
▶debiandebian/linux< linux 6.1.128-1 (bookworm)

Patches

Patch: git.kernel.org ↗Patch: git.kernel.org ↗Patch: git.kernel.org ↗

🔴Vulnerability Details

29
OSV
linux-oracle-6.8 vulnerabilities↗2025-05-29
▶
OSV
linux-hwe-6.8 vulnerabilities↗2025-05-28
▶
OSV
linux-raspi vulnerabilities↗2025-05-26
▶
OSV
linux-azure-nvidia vulnerabilities↗2025-05-20
▶
OSV
linux-raspi-realtime vulnerabilities↗2025-05-20
▶

📋Vendor Advisories

29
Ubuntu
Linux kernel (Oracle) vulnerabilities↗2025-05-29
▶
Ubuntu
Linux kernel (HWE) vulnerabilities↗2025-05-28
▶
Ubuntu
Linux kernel (Raspberry Pi) vulnerabilities↗2025-05-26
▶
Ubuntu
Linux kernel vulnerabilities↗2025-05-20
▶
Ubuntu
Linux kernel (Azure, N-Series) vulnerabilities↗2025-05-20
▶