BaseFortify

Publication date: 2025-10-15

Last updated on: 2025-10-16

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: blk-mq: fix blk_mq_tags double free while nr_requests grown In the case user trigger tags grow by queue sysfs attribute nr_requests, hctx->sched_tags will be freed directly and replaced with a new allocated tags, see blk_mq_tag_update_depth(). The problem is that hctx->sched_tags is from elevator->et->tags, while et->tags is still the freed tags, hence later elevator exit will try to free the tags again, causing kernel panic. Fix this problem by replacing et->tags with new allocated tags as well. Noted there are still some long term problems that will require some refactor to be fixed thoroughly[1]. [1] https://lore.kernel.org/all/[email protected]/

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-10-15

Last Modified

2025-10-16

Generated

2026-07-06

AI Q&A

2025-10-15

EPSS Evaluated

2026-07-05

NVD

CVE-2025-39999

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	From 5.15.160 (inc) to 5.16 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is a double free issue in the Linux kernel's blk-mq subsystem. When the number of requests (nr_requests) grows via the queue sysfs attribute, the blk_mq_tags structure is freed and replaced with a new allocation. However, the elevator's tags pointer still references the freed memory, causing it to be freed again later during elevator exit. This double free can lead to a kernel panic. The fix involves updating the elevator's tags pointer to the new allocation to prevent the double free.

Impact Analysis

This vulnerability can cause a kernel panic, which leads to a system crash and potential denial of service. If exploited or triggered, it can disrupt system availability and stability, potentially causing data loss or requiring a system reboot.

Hi! I’m here to help you understand CVE-2025-39999. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70