CVE-2025-21739 - Vulnerability Details

- scsi: ufs: core: Fix use-after free in init error and remove paths

Description

In the Linux kernel, the following vulnerability has been resolved:

scsi: ufs: core: Fix use-after free in init error and remove paths

devm_blk_crypto_profile_init() registers a cleanup handler to run when
the associated (platform-) device is being released. For UFS, the
crypto private data and pointers are stored as part of the ufs_hba's
data structure 'struct ufs_hba::crypto_profile'. This structure is
allocated as part of the underlying ufshcd and therefore Scsi_host
allocation.

During driver release or during error handling in ufshcd_pltfrm_init(),
this structure is released as part of ufshcd_dealloc_host() before the
(platform-) device associated with the crypto call above is released.
Once this device is released, the crypto cleanup code will run, using
the just-released 'struct ufs_hba::crypto_profile'. This causes a
use-after-free situation:

Call trace:
kfree+0x60/0x2d8 (P)
kvfree+0x44/0x60
blk_crypto_profile_destroy_callback+0x28/0x70
devm_action_release+0x1c/0x30
release_nodes+0x6c/0x108
devres_release_all+0x98/0x100
device_unbind_cleanup+0x20/0x70
really_probe+0x218/0x2d0

In other words, the initialisation code flow is:

platform-device probe
ufshcd_pltfrm_init()
ufshcd_alloc_host()
scsi_host_alloc()
allocation of struct ufs_hba
creation of scsi-host devices
devm_blk_crypto_profile_init()
devm registration of cleanup handler using platform-device

and during error handling of ufshcd_pltfrm_init() or during driver
removal:

ufshcd_dealloc_host()
scsi_host_put()
put_device(scsi-host)
release of struct ufs_hba
put_device(platform-device)
crypto cleanup handler

To fix this use-after free, change ufshcd_alloc_host() to register a
devres action to automatically cleanup the underlying SCSI device on
ufshcd destruction, without requiring explicit calls to
ufshcd_dealloc_host(). This way:

* the crypto profile and all other ufs_hba-owned resources are
destroyed before SCSI (as they've been registered after)
* a memleak is plugged in tc-dwc-g210-pci.c remove() as a
side-effect
* EXPORT_SYMBOL_GPL(ufshcd_dealloc_host) can be removed fully as
it's not needed anymore
* no future drivers using ufshcd_alloc_host() could ever forget
adding the cleanup

Published: 2025-02-27

Score: 7.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A use‑after‑free vulnerability exists in the UFS driver of the Linux kernel. The flaw causes the crypto cleanup routine to run after the underlying UFS host structure has already been freed during device removal or an error in the initialization path. This leads to kernel memory corruption that can grant an attacker the ability to execute arbitrary code or elevate privileges. The weakness is classified as CWE‑416, a classic use‑after‑free issue.

Affected Systems

The vulnerability affects Linux kernel builds that include UFS support, starting with version 6.14 RC1 and continuing through all later releases until the patch is applied. All Linux distributions that ship these kernel versions are impacted.

Risk and Exploitability

The CVSS score of 7.8 reflects a medium‑to‑high impact. EPSS indicates an exploitation probability of less than 1%, and the flaw is not listed in CISA KEV. Exploitation requires local or privileged access to trigger a UFS device removal or initialization failure, so there is no known remote attack vector. The likely attack path is inferred to be local, requiring the attacker to influence driver unload or error handling on the target system.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`d76d9d7d1009968dd3a0fc30e5f5ee9fbffc1350`	affected	< 0dc539b888fb5f56b6eeddd95433eab557d4b0c1
`d76d9d7d1009968dd3a0fc30e5f5ee9fbffc1350`	affected	< 0c77c0d754fe83cb154715fcfec6c3faef94f207
`d76d9d7d1009968dd3a0fc30e5f5ee9fbffc1350`	affected	< 9c185beae09a3eb85f54777edafa227f7e03075d
`d76d9d7d1009968dd3a0fc30e5f5ee9fbffc1350`	affected	< f8fb2403ddebb5eea0033d90d9daae4c88749ada

Linux

affected

Version	Status	Constraints
`5.12`	affected	—
`0`	unaffected	< 5.12
`6.6.135`	unaffected	≤ 6.6.*
`6.12.14`	unaffected	≤ 6.12.*
`6.13.3`	unaffected	≤ 6.13.*
`6.14`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel:6.14:rc1::::::

No data.

No data available yet.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a release that includes the UFS use‑after‑free fix (e.g., applying commit 0c77c0d754fe).
If an upgrade cannot be performed immediately, disable or remove UFS storage devices to avoid triggering the error path.
Monitor system logs for UFS‑related kernel panics or OOPS events and apply kernel patches as soon as they become available.

Generated by OpenCVE AI on April 20, 2026 at 15:54 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
EUVD	EUVD-2025-5177	In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Fix use-after free in init error and remove paths devm_blk_crypto_profile_init() registers a cleanup handler to run when the associated (platform-) device is being released. For UFS, the crypto private data and pointers are stored as part of the ufs_hba's data structure 'struct ufs_hba::crypto_profile'. This structure is allocated as part of the underlying ufshcd and therefore Scsi_host allocation. During driver release or during error handling in ufshcd_pltfrm_init(), this structure is released as part of ufshcd_dealloc_host() before the (platform-) device associated with the crypto call above is released. Once this device is released, the crypto cleanup code will run, using the just-released 'struct ufs_hba::crypto_profile'. This causes a use-after-free situation: Call trace: kfree+0x60/0x2d8 (P) kvfree+0x44/0x60 blk_crypto_profile_destroy_callback+0x28/0x70 devm_action_release+0x1c/0x30 release_nodes+0x6c/0x108 devres_release_all+0x98/0x100 device_unbind_cleanup+0x20/0x70 really_probe+0x218/0x2d0 In other words, the initialisation code flow is: platform-device probe ufshcd_pltfrm_init() ufshcd_alloc_host() scsi_host_alloc() allocation of struct ufs_hba creation of scsi-host devices devm_blk_crypto_profile_init() devm registration of cleanup handler using platform-device and during error handling of ufshcd_pltfrm_init() or during driver removal: ufshcd_dealloc_host() scsi_host_put() put_device(scsi-host) release of struct ufs_hba put_device(platform-device) crypto cleanup handler To fix this use-after free, change ufshcd_alloc_host() to register a devres action to automatically cleanup the underlying SCSI device on ufshcd destruction, without requiring explicit calls to ufshcd_dealloc_host(). This way: * the crypto profile and all other ufs_hba-owned resources are destroyed before SCSI (as they've been registered after) * a memleak is plugged in tc-dwc-g210-pci.c remove() as a side-effect * EXPORT_SYMBOL_GPL(ufshcd_dealloc_host) can be removed fully as it's not needed anymore * no future drivers using ufshcd_alloc_host() could ever forget adding the cleanup
Ubuntu USN	USN-7521-1	Linux kernel vulnerabilities
Ubuntu USN	USN-7521-2	Linux kernel (AWS) vulnerabilities
Ubuntu USN	USN-7521-3	Linux kernel vulnerabilities
Ubuntu USN	USN-7651-1	Linux kernel vulnerabilities
Ubuntu USN	USN-7651-2	Linux kernel vulnerabilities
Ubuntu USN	USN-7651-3	Linux kernel vulnerabilities
Ubuntu USN	USN-7651-4	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-7651-5	Linux kernel (Raspberry Pi Real-time) vulnerabilities
Ubuntu USN	USN-7651-6	Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN	USN-7652-1	Linux kernel (Real-time) vulnerabilities
Ubuntu USN	USN-7653-1	Linux kernel (HWE) vulnerabilities
Ubuntu USN	USN-7737-1	Linux kernel (Azure) vulnerabilities

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00014.

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://git.kernel.org/stable/c/0c77c0d754fe83cb154715fcfec6c3faef94f207
https://git.kernel.org/stable/c/0dc539b888fb5f56b6eeddd95433eab557d4b0c1
https://git.kernel.org/stable/c/9c185beae09a3eb85f54777edafa227f7e03075d
https://git.kernel.org/stable/c/f8fb2403ddebb5eea0033d90d9daae4c88749ada
https://lore.kernel.org/linux-cve-announce/2025022659-CVE-2025-21739-5578@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2025-21739
https://www.cve.org/CVERecord?id=CVE-2025-21739

History

Sat, 18 Apr 2026 09:15:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/0dc539b888fb5f56b6eeddd95433eab557d4b0c1

Mon, 24 Mar 2025 17:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel:::::::: cpe:2.3:o:linux:linux_kernel:6.14:rc1::::::
Vendors & Products		Linux Linux linux Kernel

Tue, 04 Mar 2025 03:45:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Fri, 28 Feb 2025 02:00:00 +0000

Type	Values Removed	Values Added
References		https://lore.kernel.org/linux-cve-announce/2025022659-CVE-2025-21739-5578@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2025-21739 https://www.cve.org/CVERecord?id=CVE-2025-21739
Metrics	threat_severity `None`	threat_severity `Moderate`

Thu, 27 Feb 2025 19:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416
Metrics		cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Thu, 27 Feb 2025 02:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Fix use-after free in init error and remove paths devm_blk_crypto_profile_init() registers a cleanup handler to run when the associated (platform-) device is being released. For UFS, the crypto private data and pointers are stored as part of the ufs_hba's data structure 'struct ufs_hba::crypto_profile'. This structure is allocated as part of the underlying ufshcd and therefore Scsi_host allocation. During driver release or during error handling in ufshcd_pltfrm_init(), this structure is released as part of ufshcd_dealloc_host() before the (platform-) device associated with the crypto call above is released. Once this device is released, the crypto cleanup code will run, using the just-released 'struct ufs_hba::crypto_profile'. This causes a use-after-free situation: Call trace: kfree+0x60/0x2d8 (P) kvfree+0x44/0x60 blk_crypto_profile_destroy_callback+0x28/0x70 devm_action_release+0x1c/0x30 release_nodes+0x6c/0x108 devres_release_all+0x98/0x100 device_unbind_cleanup+0x20/0x70 really_probe+0x218/0x2d0 In other words, the initialisation code flow is: platform-device probe ufshcd_pltfrm_init() ufshcd_alloc_host() scsi_host_alloc() allocation of struct ufs_hba creation of scsi-host devices devm_blk_crypto_profile_init() devm registration of cleanup handler using platform-device and during error handling of ufshcd_pltfrm_init() or during driver removal: ufshcd_dealloc_host() scsi_host_put() put_device(scsi-host) release of struct ufs_hba put_device(platform-device) crypto cleanup handler To fix this use-after free, change ufshcd_alloc_host() to register a devres action to automatically cleanup the underlying SCSI device on ufshcd destruction, without requiring explicit calls to ufshcd_dealloc_host(). This way: * the crypto profile and all other ufs_hba-owned resources are destroyed before SCSI (as they've been registered after) * a memleak is plugged in tc-dwc-g210-pci.c remove() as a side-effect * EXPORT_SYMBOL_GPL(ufshcd_dealloc_host) can be removed fully as it's not needed anymore * no future drivers using ufshcd_alloc_host() could ever forget adding the cleanup
Title		scsi: ufs: core: Fix use-after free in init error and remove paths
References		https://git.kernel.org/stable/c/0c77c0d754fe83cb154715fcfec6c3faef94f207 https://git.kernel.org/stable/c/9c185beae09a3eb85f54777edafa227f7e03075d https://git.kernel.org/stable/c/f8fb2403ddebb5eea0033d90d9daae4c88749ada

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2025-02-27T02:12:14.581Z

Updated: 2026-05-11T21:05:30.597Z

Reserved: 2024-12-29T08:45:45.757Z

Link: CVE-2025-21739

Vulnrichment

Updated: 2025-02-27T18:14:31.582Z

NVD

Status : Modified

Published: 2025-02-27T03:15:14.530

Modified: 2026-04-18T09:16:09.683

Link: CVE-2025-21739

Redhat

Severity : Moderate

Publid Date: 2025-02-27T00:00:00Z

Links: CVE-2025-21739 - Bugzilla

OpenCVE Enrichment

Updated: 2026-04-20T16:00:10Z

Weaknesses

CWE-416

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Exploitation none

Automatable no

Technical Impact total

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object