PT-2025-42273 · Linux · Linux Kernel
Published
2025-09-05
·
Updated
2026-03-07
·
CVE-2025-39999
CVSS v2.0
6.0
Medium
| Vector | AV:L/AC:H/Au:S/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
A flaw exists in the Linux kernel’s block management queue (blk-mq) subsystem related to double freeing of memory associated with request tags when the number of requests grows. Specifically, when a user triggers an increase in tags via the
nr requests queue sysfs attribute, the hctx->sched tags structure is freed and replaced with newly allocated tags. However, the original et->tags still points to the freed memory, leading to a double free during elevator exit, potentially causing a kernel panic. The fix involves replacing both hctx->sched tags and et->tags with new allocated tags. The issue is noted to have long-term problems that require refactoring for a thorough fix.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
Improper Resource Release
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Linux Kernel