CVE-2025-39999

Vulnerability

In the Linux kernel's block multi-queue (blk-mq) subsystem, a double-free vulnerability exists in the handling of scheduler tags when the nr_requests sysfs attribute is modified. When a user triggers a tags grow operation via the queue's sysfs attribute, hctx->sched_tags is freed and replaced with a new allocated tags structure. However, the elevator's et->tags pointer still references the freed tags, leading to a double-free when the elevator exits and attempts to free the tags again, resulting in a kernel panic [1].

Exploitation

An attacker with the ability to write to the write to the nr_requests sysfs attribute of a block device queue can trigger this vulnerability. This requires local access to the system and the ability to modify kernel parameters, typically requiring root privileges or CAP_SYS_ADMIN. The attack surface is limited to systems where the user can change the nr_requests value for a block device that uses an elevator with scheduler tags [1].

Impact

Successful exploitation leads to a kernel panic, causing a denial of service (DoS) condition. The system becomes unavailable until rebooted. There is no evidence of code execution or privilege escalation from this vulnerability [1].

Mitigation

Mitigation

The fix has been applied in the Linux kernel stable tree. The commit replaces et->tags with the newly allocated tags to prevent the double-free. Users should apply the latest kernel updates from their distribution. The vulnerability is tracked in the Linux kernel git repository [1].