Use-After-Free Vulnerability in Linux Kernel's UFS Driver
Summary
DEBIAN-CVE-2025-21739: In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Fix use-after free in init error and remove paths devm_blk_crypto_profile_init() registers a cleanup handler to run when the associated... Affects linux versions < 6.12.15-1. Fixed in 6.12.15-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Linux kernel is the core component of a Linux operating system, managing hardware and system resources. The UFS (Universal Flash Storage) driver is responsible for interfacing with UFS devices, providing a standardized way to access storage. This driver is crucial for modern devices that rely on UFS for high-speed data transfer. However, a vulnerability has been identified that can lead to serious security issues if not addressed.
Vulnerability Detail
In the Linux kernel, a use-after-free vulnerability has been discovered in the UFS driver. This occurs when the crypto profile associated with the UFS host bus adapter (HBA) is released before the platform device is fully cleaned up. As a result, the cleanup handler attempts to access memory that has already been freed, leading to potential exploitation. The vulnerability can cause system instability and may allow attackers to execute arbitrary code, compromising the integrity of the system.
How To Fix
Minimum fixed version
6.12.15-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. The best course of action is to apply the patch as soon as it becomes available.
Conclusion
The identified use-after-free vulnerability in the Linux kernel's UFS driver poses significant risks to system security and stability. Users are urged to update their systems to the latest patched version to mitigate these risks. Regular monitoring and updates are essential for maintaining a secure environment.
See every vulnerability recorded for linux →
FAQ
A use-after-free vulnerability occurs when a program continues to use a pointer after the memory it points to has been freed. This can lead to unpredictable behavior and security risks.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. By uploading your manifest file, you can check if your application is affected by this vulnerability.
Exploitation of this vulnerability could lead to system crashes, data corruption, or unauthorized access to system resources, potentially allowing attackers to execute arbitrary code.
Yes, if exploited, this vulnerability could lead to data corruption or loss, as the system may behave unpredictably when accessing freed memory.
It is recommended to regularly check for updates and apply them promptly to ensure that your system is protected against known vulnerabilities.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
