CVE-2025-21739

Summary

CVE-2025-21739 is a use-after-free vulnerability affecting the Linux kernel's SCSI subsystem, specifically the UFS file system driver. The issue arises due to a misaligned cleanup handler registration sequence. During driver release or error handling, the ufshcd_pltfrm_init() function releases the associated device before the crypto cleanup code runs, leading to a use-after-free scenario. To mitigate this vulnerability, it's recommended to change ufshcd_alloc_host() to register a devres action that cleans up the underlying SCSI device on ufshcd destruction. This approach ensures that all UFS-related resources are destroyed before the SCSI device, preventing use-after-free situations and eliminating the need for explicit ufshcd_dealloc_host() calls.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.