CVE-2025-21631: Linux Kernel Use-After-Free Vulnerability

CVE-2025-21631 Overview

CVE-2025-21631 is a use-after-free (UAF) vulnerability in the Linux kernel's Budget Fair Queueing (BFQ) I/O scheduler. The flaw resides in block/bfq-iosched.c and involves the waker_bfqq pointer becoming stale after a call to bfq_split_bfqq(). A syzkaller-reported KASAN slab-use-after-free was triggered in bfq_init_rq() during normal filesystem operations. The vulnerability is classified under [CWE-416: Use After Free] and affects multiple Linux kernel versions, including the 6.13 release candidates. Local attackers with low privileges can exploit this issue to compromise confidentiality, integrity, and availability of the affected system.

Critical Impact
A local, low-privileged user can trigger memory corruption in the BFQ I/O scheduler, potentially leading to kernel-level code execution, privilege escalation, or denial of service on affected Linux systems.

Affected Products

Linux Kernel versions prior to the patched commits (multiple stable branches)
Linux Kernel 6.13 release candidates (rc1 through rc6)
Distributions shipping affected kernels, including Debian LTS

Discovery Timeline

2025-01-19 - CVE-2025-21631 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-21631

Vulnerability Analysis

The vulnerability is a use-after-free condition in the BFQ I/O scheduler, which is a completely fair queueing scheduler that grants I/O bandwidth to processes based on budgets. BFQ maintains a waker_bfqq pointer to track the queue that repeatedly wakes another queue, enabling scheduler optimizations for producer-consumer I/O patterns.

When bfq_split_bfqq() runs, it splits a shared BFQ queue and may free the queue structure previously referenced by another queue's waker_bfqq pointer. The pointer is not cleared, leaving a dangling reference. Subsequent access via bfq_init_rq() and hlist_add_head() at block/bfq-iosched.c:6958 dereferences the freed memory, producing the KASAN slab-use-after-free reported by syzkaller.

The reported call chain originates from ordinary filesystem workloads. An ioctl(FIEMAP) on ext4 triggers ext4_fiemap() and submit_bio_noacct(), which reaches bfq_insert_request() and ultimately bfq_init_rq(), where the freed waker_bfqq is touched.

Root Cause

The root cause is missing lifetime management of the waker_bfqq reference. bfq_split_bfqq() releases the associated bfq_queue without invalidating pointers to it held by sibling queues. The scheduler assumes the referenced queue remains valid, violating the object ownership contract between the split and initialization code paths.

Attack Vector

Exploitation requires local access with the ability to submit I/O against a block device using the BFQ scheduler. An attacker crafts an I/O workload that repeatedly creates, splits, and re-references BFQ queues, driving the scheduler through the vulnerable state transition. Successful exploitation of a UAF in kernel context can enable arbitrary kernel memory writes, privilege escalation to root, or a kernel panic.

No verified public proof-of-concept is available beyond the syzkaller reproducer referenced in the upstream commit messages. Refer to the upstream kernel commit for the technical fix details.

Detection Methods for CVE-2025-21631

Indicators of Compromise

KASAN reports containing slab-use-after-free in bfq_init_rq in dmesg or kernel logs
Unexpected kernel oops or panic messages referencing bfq-iosched.c, bfq_split_bfqq, or hlist_add_head
Processes performing unusual patterns of ioctl(FIEMAP) or high-frequency block I/O on BFQ-managed devices

Detection Strategies

Inventory kernel versions across the fleet and flag hosts running vulnerable kernels, particularly 6.13-rc builds and unpatched stable branches
Monitor kernel ring buffers for KASAN, BUG, or general protection fault entries originating from block layer functions
Correlate crash telemetry with the presence of the BFQ scheduler by inspecting /sys/block/<dev>/queue/scheduler

Monitoring Recommendations

Forward journald and kmsg events to a centralized log platform and alert on kernel oops signatures involving BFQ
Track privilege escalation attempts and unexpected uid transitions on Linux hosts that follow block I/O anomalies
Baseline block I/O behavior per host and alert on processes producing atypical BFQ queue churn

How to Mitigate CVE-2025-21631

Immediate Actions Required

Apply the vendor-provided kernel updates from your Linux distribution as soon as they are available
For Debian systems, install the updated kernel packages referenced in the Debian LTS Announcement
Reboot affected hosts to load the patched kernel after installation

Patch Information

Upstream fixes are available in the following kernel commits: 2550149, bc2aeb3, be3eed5, f587c1a, and fcede1f. The fix clears or revalidates the waker_bfqq pointer after bfq_split_bfqq() executes, eliminating the dangling reference.

Workarounds

Switch the I/O scheduler from bfq to mq-deadline or none on affected block devices until patching is possible
Restrict local access on multi-tenant Linux systems and enforce least privilege for interactive users
Enable kernel hardening features such as KASLR and SMEP/SMAP to raise exploitation cost

bash

# Verify the active I/O scheduler on a block device
cat /sys/block/sda/queue/scheduler

# Temporarily switch away from BFQ (root required)
echo mq-deadline | sudo tee /sys/block/sda/queue/scheduler

# Persist the change via udev rule (example)
echo 'ACTION=="add|change", KERNEL=="sd[a-z]", ATTR{queue/scheduler}="mq-deadline"' | \
  sudo tee /etc/udev/rules.d/60-io-scheduler.rules