{
  "threat_severity" : "Moderate",
  "public_date" : "2025-02-27T00:00:00Z",
  "bugzilla" : {
    "description" : "kernel: scsi: ufs: core: Fix use-after free in init error and remove paths",
    "id" : "2348585",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2348585"
  },
  "cvss3" : {
    "cvss3_base_score" : "6.7",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
    "status" : "verified"
  },
  "cwe" : "CWE-416",
  "details" : [ "In the Linux kernel, the following vulnerability has been resolved:\nscsi: ufs: core: Fix use-after free in init error and remove paths\ndevm_blk_crypto_profile_init() registers a cleanup handler to run when\nthe associated (platform-) device is being released. For UFS, the\ncrypto private data and pointers are stored as part of the ufs_hba's\ndata structure 'struct ufs_hba::crypto_profile'. This structure is\nallocated as part of the underlying ufshcd and therefore Scsi_host\nallocation.\nDuring driver release or during error handling in ufshcd_pltfrm_init(),\nthis structure is released as part of ufshcd_dealloc_host() before the\n(platform-) device associated with the crypto call above is released.\nOnce this device is released, the crypto cleanup code will run, using\nthe just-released 'struct ufs_hba::crypto_profile'. This causes a\nuse-after-free situation:\nCall trace:\nkfree+0x60/0x2d8 (P)\nkvfree+0x44/0x60\nblk_crypto_profile_destroy_callback+0x28/0x70\ndevm_action_release+0x1c/0x30\nrelease_nodes+0x6c/0x108\ndevres_release_all+0x98/0x100\ndevice_unbind_cleanup+0x20/0x70\nreally_probe+0x218/0x2d0\nIn other words, the initialisation code flow is:\nplatform-device probe\nufshcd_pltfrm_init()\nufshcd_alloc_host()\nscsi_host_alloc()\nallocation of struct ufs_hba\ncreation of scsi-host devices\ndevm_blk_crypto_profile_init()\ndevm registration of cleanup handler using platform-device\nand during error handling of ufshcd_pltfrm_init() or during driver\nremoval:\nufshcd_dealloc_host()\nscsi_host_put()\nput_device(scsi-host)\nrelease of struct ufs_hba\nput_device(platform-device)\ncrypto cleanup handler\nTo fix this use-after free, change ufshcd_alloc_host() to register a\ndevres action to automatically cleanup the underlying SCSI device on\nufshcd destruction, without requiring explicit calls to\nufshcd_dealloc_host(). This way:\n* the crypto profile and all other ufs_hba-owned resources are\ndestroyed before SCSI (as they've been registered after)\n* a memleak is plugged in tc-dwc-g210-pci.c remove() as a\nside-effect\n* EXPORT_SYMBOL_GPL(ufshcd_dealloc_host) can be removed fully as\nit's not needed anymore\n* no future drivers using ufshcd_alloc_host() could ever forget\nadding the cleanup" ],
  "affected_release" : [ {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2025-11-11T00:00:00Z",
    "advisory" : "RHSA-2025:20518",
    "cpe" : "cpe:/a:redhat:enterprise_linux:9",
    "package" : "kernel-0:5.14.0-611.5.1.el9_7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2025-11-11T00:00:00Z",
    "advisory" : "RHSA-2025:20518",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9",
    "package" : "kernel-0:5.14.0-611.5.1.el9_7"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 10",
    "fix_state" : "Affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Not affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Not affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2025-21739\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-21739\nhttps://lore.kernel.org/linux-cve-announce/2025022659-CVE-2025-21739-5578@gregkh/T" ],
  "name" : "CVE-2025-21739",
  "csaw" : false
}