CVE-2025-21631

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2025-21631
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-21631.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2025-21631
Related
Published
2025-01-19T11:15:07Z
Modified
2025-02-03T16:59:42.172615Z
Severity
  • 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

In the Linux kernel, the following vulnerability has been resolved:

block, bfq: fix wakerbfqq UAF after bfqsplit_bfqq()

Our syzkaller report a following UAF for v6.6:

BUG: KASAN: slab-use-after-free in bfqinitrq+0x175d/0x17a0 block/bfq-iosched.c:6958 Read of size 8 at addr ffff8881b57147d8 by task fsstress/232726

CPU: 2 PID: 232726 Comm: fsstress Not tainted 6.6.0-g3629d1885222 #39 Call Trace: <TASK> _dumpstack lib/dumpstack.c:88 [inline] dumpstacklvl+0x91/0xf0 lib/dumpstack.c:106 printaddressdescription.constprop.0+0x66/0x300 mm/kasan/report.c:364 printreport+0x3e/0x70 mm/kasan/report.c:475 kasanreport+0xb8/0xf0 mm/kasan/report.c:588 hlistaddhead include/linux/list.h:1023 [inline] bfqinitrq+0x175d/0x17a0 block/bfq-iosched.c:6958 bfqinsertrequest.isra.0+0xe8/0xa20 block/bfq-iosched.c:6271 bfqinsertrequests+0x27f/0x390 block/bfq-iosched.c:6323 blkmqinsertrequest+0x290/0x8f0 block/blk-mq.c:2660 blkmqsubmitbio+0x1021/0x15e0 block/blk-mq.c:3143 _submitbio+0xa0/0x6b0 block/blk-core.c:639 _submitbionoacctmq block/blk-core.c:718 [inline] submitbionoacctnocheck+0x5b7/0x810 block/blk-core.c:747 submitbionoacct+0xca0/0x1990 block/blk-core.c:847 _ext4readbh fs/ext4/super.c:205 [inline] ext4readbh+0x15e/0x2e0 fs/ext4/super.c:230 _readextenttreeblock+0x304/0x6f0 fs/ext4/extents.c:567 ext4findextent+0x479/0xd20 fs/ext4/extents.c:947 ext4extmapblocks+0x1a3/0x2680 fs/ext4/extents.c:4182 ext4mapblocks+0x929/0x15a0 fs/ext4/inode.c:660 ext4iomapbeginreport+0x298/0x480 fs/ext4/inode.c:3569 iomapiter+0x3dd/0x1010 fs/iomap/iter.c:91 iomapfiemap+0x1f4/0x360 fs/iomap/fiemap.c:80 ext4fiemap+0x181/0x210 fs/ext4/extents.c:5051 ioctlfiemap.isra.0+0x1b4/0x290 fs/ioctl.c:220 dovfsioctl+0x31c/0x11a0 fs/ioctl.c:811 _dosysioctl fs/ioctl.c:869 [inline] _sesysioctl+0xae/0x190 fs/ioctl.c:857 dosyscallx64 arch/x86/entry/common.c:51 [inline] dosyscall64+0x70/0x120 arch/x86/entry/common.c:81 entrySYSCALL64afterhwframe+0x78/0xe2

Allocated by task 232719: kasansavestack+0x22/0x50 mm/kasan/common.c:45 kasansettrack+0x25/0x30 mm/kasan/common.c:52 _kasanslaballoc+0x87/0x90 mm/kasan/common.c:328 kasanslaballoc include/linux/kasan.h:188 [inline] slabpostallochook mm/slab.h:768 [inline] slaballocnode mm/slub.c:3492 [inline] kmemcacheallocnode+0x1b8/0x6f0 mm/slub.c:3537 bfqgetqueue+0x215/0x1f00 block/bfq-iosched.c:5869 bfqgetbfqqhandlesplit+0x167/0x5f0 block/bfq-iosched.c:6776 bfqinitrq+0x13a4/0x17a0 block/bfq-iosched.c:6938 bfqinsertrequest.isra.0+0xe8/0xa20 block/bfq-iosched.c:6271 bfqinsertrequests+0x27f/0x390 block/bfq-iosched.c:6323 blkmqinsertrequest+0x290/0x8f0 block/blk-mq.c:2660 blkmqsubmitbio+0x1021/0x15e0 block/blk-mq.c:3143 _submitbio+0xa0/0x6b0 block/blk-core.c:639 _submitbionoacctmq block/blk-core.c:718 [inline] submitbionoacctnocheck+0x5b7/0x810 block/blk-core.c:747 submitbionoacct+0xca0/0x1990 block/blk-core.c:847 _ext4readbh fs/ext4/super.c:205 [inline] ext4readbhnowait+0x15a/0x240 fs/ext4/super.c:217 ext4readbhlock+0xac/0xd0 fs/ext4/super.c:242 ext4breadbatch+0x268/0x500 fs/ext4/inode.c:958 _ext4findentry+0x448/0x10f0 fs/ext4/namei.c:1671 ext4lookupentry fs/ext4/namei.c:1774 [inline] ext4lookup.part.0+0x359/0x6f0 fs/ext4/namei.c:1842 ext4lookup+0x72/0x90 fs/ext4/namei.c:1839 _lookupslow+0x257/0x480 fs/namei.c:1696 lookupslow fs/namei.c:1713 [inline] walkcomponent+0x454/0x5c0 fs/namei.c:2004 linkpathwalk.part.0+0x773/0xda0 fs/namei.c:2331 linkpathwalk fs/namei.c:3826 [inline] pathopenat+0x1b9/0x520 fs/namei.c:3826 dofilpopen+0x1b7/0x400 fs/namei.c:3857 dosysopenat2+0x5dc/0x6e0 fs/open.c:1428 dosysopen fs/open.c:1443 [inline] _dosysopenat fs/open.c:1459 [inline] _sesysopenat fs/open.c:1454 [inline] _x64sysopenat+0x148/0x200 fs/open.c:1454 dosyscallx64 arch/x86/entry/common.c:51 [inline] dosyscall6 ---truncated---

References

Affected packages

Debian:12 / linux

Package

Name
linux
Purl
pkg:deb/debian/linux?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

6.*

6.1.27-1
6.1.37-1
6.1.38-1
6.1.38-2~bpo11+1
6.1.38-2
6.1.38-3
6.1.38-4~bpo11+1
6.1.38-4
6.1.52-1
6.1.55-1~bpo11+1
6.1.55-1
6.1.64-1
6.1.66-1
6.1.67-1
6.1.69-1~bpo11+1
6.1.69-1
6.1.76-1~bpo11+1
6.1.76-1
6.1.82-1
6.1.85-1
6.1.90-1~bpo11+1
6.1.90-1
6.1.94-1~bpo11+1
6.1.94-1
6.1.98-1
6.1.99-1
6.1.106-1
6.1.106-2
6.1.106-3
6.1.112-1
6.1.115-1
6.1.119-1
6.1.123-1
6.1.124-1
6.3.1-1~exp1
6.3.2-1~exp1
6.3.4-1~exp1
6.3.5-1~exp1
6.3.7-1~bpo12+1
6.3.7-1
6.3.11-1
6.4~rc6-1~exp1
6.4~rc7-1~exp1
6.4.1-1~exp1
6.4.4-1~bpo12+1
6.4.4-1
6.4.4-2
6.4.4-3~bpo12+1
6.4.4-3
6.4.11-1
6.4.13-1
6.5~rc4-1~exp1
6.5~rc6-1~exp1
6.5~rc7-1~exp1
6.5.1-1~exp1
6.5.3-1~bpo12+1
6.5.3-1
6.5.6-1
6.5.8-1
6.5.10-1~bpo12+1
6.5.10-1
6.5.13-1
6.6.3-1~exp1
6.6.4-1~exp1
6.6.7-1~exp1
6.6.8-1
6.6.9-1
6.6.11-1
6.6.13-1~bpo12+1
6.6.13-1
6.6.15-1
6.6.15-2
6.7-1~exp1
6.7.1-1~exp1
6.7.4-1~exp1
6.7.7-1
6.7.9-1
6.7.9-2
6.7.12-1~bpo12+1
6.7.12-1
6.8.9-1
6.8.11-1
6.8.12-1~bpo12+1
6.8.12-1
6.9.2-1~exp1
6.9.7-1~bpo12+1
6.9.7-1
6.9.8-1
6.9.9-1
6.9.10-1~bpo12+1
6.9.10-1
6.9.11-1
6.9.12-1
6.10-1~exp1
6.10.1-1~exp1
6.10.3-1
6.10.4-1
6.10.6-1~bpo12+1
6.10.6-1
6.10.7-1
6.10.9-1
6.10.11-1~bpo12+1
6.10.11-1
6.10.12-1
6.11~rc4-1~exp1
6.11~rc5-1~exp1
6.11-1~exp1
6.11.2-1
6.11.4-1
6.11.5-1~bpo12+1
6.11.5-1
6.11.6-1
6.11.7-1
6.11.9-1
6.11.10-1~bpo12+1
6.11.10-1
6.12~rc6-1~exp1
6.12.3-1
6.12.5-1
6.12.6-1
6.12.8-1
6.12.9-1~bpo12+1
6.12.9-1
6.12.9-1+alpha
6.12.10-1
6.12.11-1
6.12.11-1+alpha
6.12.12-1
6.13~rc6-1~exp1
6.13~rc7-1~exp1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:13 / linux

Package

Name
linux
Purl
pkg:deb/debian/linux?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
6.12.10-1

Affected versions

6.*

6.1.27-1
6.1.37-1
6.1.38-1
6.1.38-2~bpo11+1
6.1.38-2
6.1.38-3
6.1.38-4~bpo11+1
6.1.38-4
6.1.52-1
6.1.55-1~bpo11+1
6.1.55-1
6.1.64-1
6.1.66-1
6.1.67-1
6.1.69-1~bpo11+1
6.1.69-1
6.1.76-1~bpo11+1
6.1.76-1
6.1.82-1
6.1.85-1
6.1.90-1~bpo11+1
6.1.90-1
6.1.94-1~bpo11+1
6.1.94-1
6.1.98-1
6.1.99-1
6.1.106-1
6.1.106-2
6.1.106-3
6.1.112-1
6.1.115-1
6.1.119-1
6.1.123-1
6.1.124-1
6.3.1-1~exp1
6.3.2-1~exp1
6.3.4-1~exp1
6.3.5-1~exp1
6.3.7-1~bpo12+1
6.3.7-1
6.3.11-1
6.4~rc6-1~exp1
6.4~rc7-1~exp1
6.4.1-1~exp1
6.4.4-1~bpo12+1
6.4.4-1
6.4.4-2
6.4.4-3~bpo12+1
6.4.4-3
6.4.11-1
6.4.13-1
6.5~rc4-1~exp1
6.5~rc6-1~exp1
6.5~rc7-1~exp1
6.5.1-1~exp1
6.5.3-1~bpo12+1
6.5.3-1
6.5.6-1
6.5.8-1
6.5.10-1~bpo12+1
6.5.10-1
6.5.13-1
6.6.3-1~exp1
6.6.4-1~exp1
6.6.7-1~exp1
6.6.8-1
6.6.9-1
6.6.11-1
6.6.13-1~bpo12+1
6.6.13-1
6.6.15-1
6.6.15-2
6.7-1~exp1
6.7.1-1~exp1
6.7.4-1~exp1
6.7.7-1
6.7.9-1
6.7.9-2
6.7.12-1~bpo12+1
6.7.12-1
6.8.9-1
6.8.11-1
6.8.12-1~bpo12+1
6.8.12-1
6.9.2-1~exp1
6.9.7-1~bpo12+1
6.9.7-1
6.9.8-1
6.9.9-1
6.9.10-1~bpo12+1
6.9.10-1
6.9.11-1
6.9.12-1
6.10-1~exp1
6.10.1-1~exp1
6.10.3-1
6.10.4-1
6.10.6-1~bpo12+1
6.10.6-1
6.10.7-1
6.10.9-1
6.10.11-1~bpo12+1
6.10.11-1
6.10.12-1
6.11~rc4-1~exp1
6.11~rc5-1~exp1
6.11-1~exp1
6.11.2-1
6.11.4-1
6.11.5-1~bpo12+1
6.11.5-1
6.11.6-1
6.11.7-1
6.11.9-1
6.11.10-1~bpo12+1
6.11.10-1
6.12~rc6-1~exp1
6.12.3-1
6.12.5-1
6.12.6-1
6.12.8-1
6.12.9-1~bpo12+1
6.12.9-1
6.12.9-1+alpha

Ecosystem specific 

{
    "urgency": "not yet assigned"
}