Use-After-Free Vulnerability in Linux Kernel's UFS Driver - CVE-2025-21739
Summary
CVE-2025-21739: In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Fix use-after free in init error and remove paths devm_blk_crypto_profile_init() registers a cleanup handler to run when the associated... Affects linux versions 6.1.106-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services for hardware and software interaction. The UFS (Universal Flash Storage) driver is responsible for managing UFS devices, which are commonly used in mobile and embedded systems. This driver facilitates communication between the operating system and UFS storage, ensuring data integrity and performance. However, a recent vulnerability has been identified that could lead to severe security issues if left unaddressed.
Vulnerability Detail
CVE-2025-21739 is a use-after-free vulnerability in the UFS driver of the Linux kernel. It arises during the initialization and error handling processes, where the crypto profile associated with the UFS host bus adapter (HBA) is released prematurely. This leads to a situation where the cleanup code attempts to access memory that has already been freed, potentially allowing an attacker to exploit this flaw to execute arbitrary code or cause a system crash. The vulnerability is particularly concerning as it affects the stability and security of systems utilizing UFS devices.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds available for this vulnerability. The best course of action is to apply the patch as soon as it becomes available.
Conclusion
CVE-2025-21739 represents a significant security vulnerability in the Linux kernel's UFS driver, which can lead to severe consequences if not addressed. Users are strongly advised to update their systems to the latest patched version to protect against potential exploits. Utilizing tools like Vulert can help in monitoring for such vulnerabilities in real-time.
See every vulnerability recorded for linux →
FAQ
CVE-2025-21739 is a use-after-free vulnerability in the UFS driver of the Linux kernel that can lead to security risks such as arbitrary code execution.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability.
If exploited, this vulnerability could allow an attacker to execute arbitrary code or crash the system, compromising its integrity and security.
Yes, users are encouraged to update their Linux packages to the latest version that includes the fix for CVE-2025-21739.
While there are no specific workarounds, it is crucial to monitor for updates and apply the patch as soon as possible to mitigate the risk.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
