CVE-2025-39999 blk-mq: fix blk_mq_tags double free while nr_requests grown
A local attacker with high privileges can trigger a double free in the Linux kernel block layer, causing a system crash.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-39999?
CVE-2025-39999 is an use after free vulnerability in Linux, published on 15 Oct 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
blk-mq: fix blk_mq_tags double free while nr_requests grown
In the case user trigger tags grow by queue sysfs attribute nr_requests, hctx->sched_tags will be freed directly and replaced with a new allocated tags, see blk_mq_tag_update_depth().
The problem is that hctx->sched_tags is from elevator->et->tags, while et->tags is still the freed tags, hence later elevator exit will try to free the tags again, causing kernel panic.
Fix this problem by replacing et->tags with new allocated tags as well.
Noted there are still some long term problems that will require some refactor to be fixed thoroughly[1].
[1] https://lore.kernel.org/all/[email protected]/
Which versions are affected by CVE-2025-39999?
How do I fix CVE-2025-39999?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2025-39999 being exploited?
There is no known exploitation of CVE-2025-39999 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2025-39999, DEBIAN-CVE-2025-39999, GHSA-28j8-2q92-jm59, UBUNTU-CVE-2025-39999.