Linux: Use After Free
CVE-2025-22126 is a high-severity use after free vulnerability in Linux, with a CVSS 3.1 base score of 7.8 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions ca9f84de76723b358dfc0606668efdca54afc2e5, d69a23d8e925f8052d657652a6875ec2712c7e33, e2a9f73ee408a460f4c9dfe03b4741d6b11652b8 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.2% chance of exploitation within 30 days, which is low compared with other CVEs.
High severity with no evidence of exploitation so far.
What to do
- Update Linux to ca9f84de76723b358dfc0606668efdca54afc2e5 or d69a23d8e925f8052d657652a6875ec2712c7e33 or e2a9f73ee408a460f4c9dfe03b4741d6b11652b8 or 5462544ccbad3fc938a71b01fa5bd3a0dc2b750a, whichever matches your release line, or a later version.
- Update Linux Kernel to 6.1.135 or 6.6.88 or 6.12.25 or 6.14.2, whichever matches your release line, or a later version.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Linux | Linux | f26514342255855f4ca3c0a92cb1cdea01c33004 up to, but not including, ca9f84de76723b358dfc0606668efdca54afc2e5; f26514342255855f4ca3c0a92cb1cdea01c33004 up to, but not including, d69a23d8e925f8052d657652a6875ec2712c7e33; f26514342255855f4ca3c0a92cb1cdea01c33004 up to, but not including, e2a9f73ee408a460f4c9dfe03b4741d6b11652b8; f26514342255855f4ca3c0a92cb1cdea01c33004 up to, but not including, 5462544ccbad3fc938a71b01fa5bd3a0dc2b750a; f26514342255855f4ca3c0a92cb1cdea01c33004 up to, but not including, 8542870237c3a48ff049b6c5df5f50c8728284fa; 6.0 | ca9f84de76723b358dfc0606668efdca54afc2e5, d69a23d8e925f8052d657652a6875ec2712c7e33, e2a9f73ee408a460f4c9dfe03b4741d6b11652b8, 5462544ccbad3fc938a71b01fa5bd3a0dc2b750a, 8542870237c3a48ff049b6c5df5f50c8728284fa |
| Linux | Linux Kernel | 6.0 up to, but not including, 6.1.135; 6.2 up to, but not including, 6.6.88; 6.7 up to, but not including, 6.12.25; 6.13 up to, but not including, 6.14.2 | 6.1.135, 6.6.88, 6.12.25, 6.14.2 |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- LocalThe attacker needs local access or must trick a user into running something.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- LowA basic user account is enough.
- User interaction
- NoneNo action by a victim is required.
- Scope
- UnchangedImpact stays within the vulnerable component.
- Confidentiality
- HighAll data handled by the component can be read.
- Integrity
- HighData or code can be modified at will.
- Availability
- HighThe component can be taken down completely.
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by NVD.
Official description
In the Linux kernel, the following vulnerability has been resolved: md: fix mddev uaf while iterating all_mddevs list While iterating all_mddevs list from md_notify_reboot() and md_exit(), list_for_each_entry_safe is used, and this can race with deletint the next mddev, causing UAF: t1: spin_lock //list_for_each_entry_safe(mddev, n, ...) mddev_get(mddev1) // assume mddev2 is the next entry spin_unlock t2: //remove mddev2 ... mddev_free spin_lock list_del spin_unlock kfree(mddev2) mddev_put(mddev1) spin_lock //continue dereference mddev2->all_mddevs The old helper for_each_mddev() actually grab the reference of mddev2 while holding the lock, to prevent from being freed. This problem can be fixed the same way, however, the code will be complex. Hence switch to use list_for_each_entry, in this case mddev_put() can free the mddev1 and it's not safe as well. Refer to md_seq_show(), also factor out a helper mddev_put_locked() to fix this problem.
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory belongs to the code that operates on the new pointer.
How developers prevent this class of flaw
- Choose a language that provides automatic memory management.
- When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.
Timeline
- CVE record published.
- Record last changed materially (score, affected products, status or references).
References
Patches and release notes
- git.kernel.org/stable/c/5462544ccbad3fc938a71b01fa5bd3a0dc2b750a
- git.kernel.org/stable/c/8542870237c3a48ff049b6c5df5f50c8728284fa
- git.kernel.org/stable/c/ca9f84de76723b358dfc0606668efdca54afc2e5
- git.kernel.org/stable/c/d69a23d8e925f8052d657652a6875ec2712c7e33
- git.kernel.org/stable/c/e2a9f73ee408a460f4c9dfe03b4741d6b11652b8
Other references
Recent Use After Free vulnerabilities
- 8.8 High severity
- 7.8 High severity
- 9.8 Critical severity
- 7.8 High severity
- 7.8 High severity
- 7.8 High severity
Spotted an error? Tell us.