CVE intelligence and bounded remediation

CVE-2025-21631 — Linux Linux Kernel security vulnerability

High CVSS 7.8

In the Linux kernel, the following vulnerability has been resolved: block, bfq: fix waker_bfqq UAF after bfq_split_bfqq() Our syzkaller report a following UAF for v6.6: BUG: KASAN: slab-use-after-free in bfq_init_rq+0x175d/0x17a0 block/bfq-iosched.c:6958 Read of size 8 at addr ffff8881b57147d8 by task fsstress/232726 CPU: 2 PID: 232726 Comm: fsstress Not tainted 6.6.0-g3629d1885222 #39 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x91/0xf0 lib/dump_stack.c:106 print_address_description.constprop.0+0x66/0x300 mm/kasan/report.c:364 print_report+0x3e/0x70 mm/kasan/report.c:475 kasan_report+0xb8/0xf0 mm/kasan/report.c:588 hlist_add_head include/linux/list.h:1023 [inline] bfq_init_rq+0x175d/0x17a0 block/bfq-iosched.c:6958 bfq_insert_request.isra.0+0xe8/0xa20 block/bfq-iosched.c:6271 bfq_insert_requests+0x27f/0x390 block/bfq-iosched.c:6323 blk_mq_insert_request+0x290/0x8f0 block/blk-mq.c:2660 blk_mq_submit_bio+0x1021/0x15e0 block/blk-mq.c:3143 __submit_bio+0xa0/0x6b0 block/blk-core.c:639 __submit_bio_noacct_mq block/blk-core.c:718 [inline] submit_bio_noacct_nocheck+0x5b7/0x810 block/blk-core.c:747 submit_bio_noacct+0xca0/0x1990 block/blk-core.c:847 __ext4_…

Severity
High
CVSS
7.8 (3.1)
Published
2025-01-19
CISA KEV
Not currently listed
Ecosystem
linux/kernel
Weaknesses
CWE-416

Affected products

  • linux / linux_kernel
  • linux / linux_kernel / 6.13

Showing 2 representative product identities from 11 source matches. Confirm exact affected versions with the linked vendor and NVD evidence.

Matched remediation archetype

Use-after-free, double free, and expired resource use

This catalog composition supplies bounded fallback guidance. Explicitly reviewed curated workflows load with the complete record below.

Check exposure

  • Trace ownership, references, callbacks, asynchronous tasks, and teardown paths around the affected object or resource.
  • Identify reachable inputs and timing or state transitions that can release the object while references remain.
  • Confirm affected builds, allocators, feature flags, architectures, and process privileges.

Remediate safely

  • Apply the maintained ownership or lifetime fix and rebuild all artifacts containing the affected native code.
  • Use explicit ownership, safe reference management, cancellation and join semantics, and idempotent teardown.
  • Add deterministic lifetime tests plus isolated sanitizer and concurrency coverage for shutdown and error paths.

Authoritative sources

Complete CVE record and remediation plan

The detailed catalog view below loads this exact record, its source evidence, and the full seven-phase agentic change plan.