GHSA-28J8-2Q92-JM59
Vulnerability from github – Published: 2025-10-15 09:30 – Updated: 2025-10-15 09:30In the Linux kernel, the following vulnerability has been resolved:
blk-mq: fix blk_mq_tags double free while nr_requests grown
In the case user trigger tags grow by queue sysfs attribute nr_requests, hctx->sched_tags will be freed directly and replaced with a new allocated tags, see blk_mq_tag_update_depth().
The problem is that hctx->sched_tags is from elevator->et->tags, while et->tags is still the freed tags, hence later elevator exit will try to free the tags again, causing kernel panic.
Fix this problem by replacing et->tags with new allocated tags as well.
Noted there are still some long term problems that will require some refactor to be fixed thoroughly[1].
[1] https://lore.kernel.org/all/20250815080216.410665-1-yukuai1@huaweicloud.com/
{
"affected": [],
"aliases": [
"CVE-2025-39999"
],
"database_specific": {
"cwe_ids": [],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-10-15T08:15:38Z",
"severity": null
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nblk-mq: fix blk_mq_tags double free while nr_requests grown\n\nIn the case user trigger tags grow by queue sysfs attribute nr_requests,\nhctx-\u003esched_tags will be freed directly and replaced with a new\nallocated tags, see blk_mq_tag_update_depth().\n\nThe problem is that hctx-\u003esched_tags is from elevator-\u003eet-\u003etags, while\net-\u003etags is still the freed tags, hence later elevator exit will try to\nfree the tags again, causing kernel panic.\n\nFix this problem by replacing et-\u003etags with new allocated tags as well.\n\nNoted there are still some long term problems that will require some\nrefactor to be fixed thoroughly[1].\n\n[1] https://lore.kernel.org/all/20250815080216.410665-1-yukuai1@huaweicloud.com/",
"id": "GHSA-28j8-2q92-jm59",
"modified": "2025-10-15T09:30:17Z",
"published": "2025-10-15T09:30:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-39999"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/392b1d64911f4de8887fe8b68299fa8bd6e5b923"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/8faee580d63bc2a54a59dcdb7f9ce4de29384fec"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/ba28afbd9eff2a6370f23ef4e6a036ab0cfda409"
}
],
"schema_version": "1.4.0",
"severity": []
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.