Critical Use-After-Free Vulnerability in Linux Kernel BFQ I/O Scheduler
Summary
CVE-2025-21631: In the Linux kernel, the following vulnerability has been resolved: block, bfq: fix waker_bfqq UAF after bfq_split_bfqq() Our syzkaller report a following UAF for v6.6: BUG: KASAN: slab-use-after-free in bfq_init_rq+0x17... Affects linux versions < 6.1.128-1. Fixed in 6.1.128-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interactions. It supports various file systems, device drivers, and system calls, making it a critical part of system performance and stability. The BFQ (Budget Fair Queueing) I/O scheduler is designed to optimize disk I/O operations, ensuring fair allocation of resources among processes. However, a recent vulnerability has been identified in the BFQ scheduler that could lead to severe system instability.
Vulnerability Detail
The vulnerability, identified as CVE-2025-21631, is a use-after-free (UAF) issue in the BFQ I/O scheduler of the Linux kernel. It arises when the system attempts to access memory that has already been freed, potentially leading to arbitrary code execution or system crashes. The vulnerability was reported through syzkaller, a tool for finding bugs in the kernel, and it affects versions of the Linux kernel up to 6.6. The specific error occurs in the bfq_init_rq function, where a freed memory address is accessed, resulting in a KASAN (Kernel Address Sanitizer) report of slab-use-after-free.
How To Fix
Minimum fixed version
6.1.128-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds available for this vulnerability. The best course of action is to apply the patch as soon as it is available.
Conclusion
CVE-2025-21631 is a critical vulnerability in the Linux kernel's BFQ I/O scheduler that poses significant risks to system stability and security. Users are strongly encouraged to update their systems to the latest patched version to mitigate these risks. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for linux →
FAQ
CVE-2025-21631 is a use-after-free vulnerability in the BFQ I/O scheduler of the Linux kernel that can lead to system instability or arbitrary code execution.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability.
Exploitation of this vulnerability could lead to system crashes, data corruption, or unauthorized access to system resources.
Yes, a patch is available in the latest versions of the Linux kernel. Users are advised to update their systems to the patched version.
While there are no specific workarounds, it is crucial to monitor your system for any unusual behavior and plan for an update as soon as possible.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
