{"id":"DEBIAN-CVE-2025-21739","details":"In the Linux kernel, the following vulnerability has been resolved:  scsi: ufs: core: Fix use-after free in init error and remove paths  devm_blk_crypto_profile_init() registers a cleanup handler to run when the associated (platform-) device is being released. For UFS, the crypto private data and pointers are stored as part of the ufs_hba's data structure 'struct ufs_hba::crypto_profile'. This structure is allocated as part of the underlying ufshcd and therefore Scsi_host allocation.  During driver release or during error handling in ufshcd_pltfrm_init(), this structure is released as part of ufshcd_dealloc_host() before the (platform-) device associated with the crypto call above is released. Once this device is released, the crypto cleanup code will run, using the just-released 'struct ufs_hba::crypto_profile'. This causes a use-after-free situation:    Call trace:    kfree+0x60/0x2d8 (P)    kvfree+0x44/0x60    blk_crypto_profile_destroy_callback+0x28/0x70    devm_action_release+0x1c/0x30    release_nodes+0x6c/0x108    devres_release_all+0x98/0x100    device_unbind_cleanup+0x20/0x70    really_probe+0x218/0x2d0  In other words, the initialisation code flow is:    platform-device probe     ufshcd_pltfrm_init()       ufshcd_alloc_host()         scsi_host_alloc()           allocation of struct ufs_hba           creation of scsi-host devices     devm_blk_crypto_profile_init()       devm registration of cleanup handler using platform-device  and during error handling of ufshcd_pltfrm_init() or during driver removal:    ufshcd_dealloc_host()     scsi_host_put()       put_device(scsi-host)         release of struct ufs_hba   put_device(platform-device)     crypto cleanup handler  To fix this use-after free, change ufshcd_alloc_host() to register a devres action to automatically cleanup the underlying SCSI device on ufshcd destruction, without requiring explicit calls to ufshcd_dealloc_host(). This way:      * the crypto profile and all other ufs_hba-owned resources are       destroyed before SCSI (as they've been registered after)     * a memleak is plugged in tc-dwc-g210-pci.c remove() as a       side-effect     * EXPORT_SYMBOL_GPL(ufshcd_dealloc_host) can be removed fully as       it's not needed anymore     * no future drivers using ufshcd_alloc_host() could ever forget       adding the cleanup","modified":"2026-09-01T16:06:10.025594956Z","published":"2025-02-27T03:15:14.530Z","upstream":["CVE-2025-21739"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2025-21739"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:12","purl":"pkg:deb/debian/linux?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.176-1"}]}],"versions":["6.1.106-1","6.1.106-2","6.1.106-3","6.1.112-1","6.1.115-1","6.1.119-1","6.1.123-1","6.1.124-1","6.1.128-1","6.1.129-1","6.1.133-1","6.1.135-1","6.1.137-1","6.1.139-1","6.1.140-1","6.1.147-1","6.1.148-1","6.1.153-1","6.1.158-1","6.1.159-1","6.1.162-1","6.1.164-1","6.1.170-1","6.1.170-2","6.1.170-3","6.1.172-1","6.1.174-1","6.1.27-1","6.1.37-1","6.1.38-1","6.1.38-2","6.1.38-2~bpo11+1","6.1.38-3","6.1.38-4","6.1.38-4~bpo11+1","6.1.52-1","6.1.55-1","6.1.55-1~bpo11+1","6.1.64-1","6.1.66-1","6.1.67-1","6.1.69-1","6.1.69-1~bpo11+1","6.1.76-1","6.1.76-1~bpo11+1","6.1.82-1","6.1.85-1","6.1.90-1","6.1.90-1~bpo11+1","6.1.94-1","6.1.94-1~bpo11+1","6.1.98-1","6.1.99-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2025-21739.json"}},{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.15-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2025-21739.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.15-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2025-21739.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}