Security readout for executives and security teams
Plain-English summary
CVE-2025-21631 is a Linux kernel memory-safety flaw in the BFQ storage scheduler. A local, low-privileged user may trigger access to freed memory, potentially causing a system crash or compromising data and system control. The supplied evidence does not establish remote or active exploitation.
Executive priority
Treat this as a high-priority maintenance issue for shared Linux infrastructure because successful memory corruption could affect system control and availability. Accelerate updates where untrusted users or workloads have local execution. For tightly controlled single-user systems, apply the fix through the next expedited kernel maintenance cycle.
Technical view
After bfq_split_bfqq(), waker_bfqq can retain a reference to a freed BFQ queue. bfq_init_rq() may later dereference that stale pointer, producing a use-after-free. The supplied CVSS 3.1 score is 7.8, reflecting local, low-privilege access with potential confidentiality, integrity, and availability impact.
Likely exposure
Exposure is highest on Linux systems using the BFQ I/O scheduler and permitting untrusted local users or workloads. The fault was observed on Linux 6.6.0. The supplied version data mixes commit identifiers and releases, so distribution backports and vendor package status must be checked individually.
Exploitation context
The issue was found through syzkaller testing and demonstrated as a KASAN use-after-free. It is not listed as KEV in the supplied bundle, and no cited source establishes active exploitation or public weaponization. Its CVSS vector indicates a local attacker needs low privileges but no user interaction.
Researcher notes
The supplied record identifies CWE-416 and a stale waker_bfqq reference after queue splitting. Stable-kernel commits provide remediation evidence, but the flattened affected-version fields contain ambiguous release and commit entries with differing default statuses. Determine exposure through vendor advisories, package changelogs, or confirmation that the relevant fix was backported.
Mitigation direction
- Install a vendor or distribution kernel update containing the cited BFQ stable fix.
- Reboot affected systems into the updated kernel after completing normal change controls.
- Prioritize shared, multi-user, and multi-tenant systems with untrusted local workloads.
- If patching is delayed, restrict untrusted local access and consult vendor guidance for temporary controls.
Validation and detection
- Inventory each system's running kernel, distribution package release, and BFQ configuration.
- Confirm whether BFQ is configured or active on storage devices handling untrusted workloads.
- Compare package changelogs with vendor advisories and cited fixes; version numbers alone may miss backports.
- After updating, confirm the running kernel corresponds to the patched package.
- Review kernel logs for related use-after-free, KASAN, or kernel-oops events; absence does not prove safety.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-416: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-21631 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/f587c1ac68956c4703857d650d9b1cd7bb2ac4d7CVE reference, Linux
- https://git.kernel.org/stable/c/2550149fcdf2934155ff625d76ad4e3d4b25bbc6CVE reference, Linux
- https://git.kernel.org/stable/c/be3eed59ac01f429ac10aaa46e26f653bcf581abCVE reference, Linux
- https://git.kernel.org/stable/c/bc2aeb35ff167e0c6b0cedf0c96a5c41e6cba1edCVE reference, Linux
- https://git.kernel.org/stable/c/fcede1f0a043ccefe9bc6ad57f12718e42f63f1dCVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/03/msg00001.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Use After Free
Use After Free represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.