CVE-2025-21739
HighCVSS 7.8Summary
W jądrze systemu Linux zidentyfikowano podatność związana z użyciem po zwolnieniu pamięci w funkcji inicjalizacji. Problem występuje podczas zwalniania urządzenia platformowego, co prowadzi do sytuacji use-after-free w kontekście profilu kryptograficznego UFS.
Risk Assessment
Podatność ta może prowadzić do nieprzewidywalnych zachowań systemu, w tym potencjalnych awarii lub naruszeń bezpieczeństwa, co stanowi zagrożenie dla stabilności i integralności systemu.
Recommendation
Zaleca się aktualizację jądra systemu Linux do wersji, w której ta podatność została naprawiona, aby uniknąć problemów związanych z użyciem po zwolnieniu pamięci oraz zapewnić bezpieczeństwo systemu.
Related vulnerabilities
- CVE-2026-94053Critical
Authentication bypass via LDAP injection in the sshd-ldap component of Apache MINA SSHD. Lack of escaping LDAP filter metacharacters enables successful authentication with username "*" and password "*".
- CVE-2026-94052Critical
A missing check in LdapPasswordAuthenticator in the sshd-ldap component of Apache MINA SSHD allows bypassing authentication checks. The vulnerability only affects servers using LdapPasswordAuthenticator for password authentication.
- CVE-2026-77185Critical
Authentication bypass in sshd-core of Apache MINA SSHD. A flaw in the implementation of the "asynchronous authentication" mechanism could potentially lead to skipping signature checks in public-key or hostbased authentication, or returning a wrong result.
- CVE-2026-102458Critical
Missing Authentication vulnerability in EasyFlow .NET by Digiwin. Unauthenticated remote attackers can obtain other users' plaintext passwords through a specific API.
- CVE-2026-102455Critical
Insecure Deserialization vulnerability in EasyFlow .NET by Digiwin. Unauthenticated remote attackers can execute arbitrary code on the server by sending maliciously crafted serialized content.
- CVE-2026-102508Critical
The OPC UA driver in Apache PLC4X (PLC4J) improperly verifies cryptographic signatures and server certificates. An attacker in a network position between client and server can impersonate the OPC UA server and read, forge, or modify secure-channel traffic, including user credentials sent by the client. The issue affects versions 0.9.0 through 0.13.1 and is fixed in version 1.0.0.
- CVE-2026-97196Critical
Improper Validation of Unsafe Equivalence in Input vulnerability in GiveWP by Liquid Web / StellarWP allows Authentication Bypass. The issue affects GiveWP from n/a through 4.16.9.
- CVE-2026-103110Critical
Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper input validation that allows a remote attacker to execute code remotely as an unprivileged user on a Pexip Infinity Conferencing Node.
- CVE-2026-102911Critical
A flaw has been found in zosmaai pi-llm-wiki up to 0.11.7. Affected is an unknown function of the file mcp/index.ts of the component wiki_capture_source MCP tool. Executing a manipulation of the argument url can lead to OS command injection. The attack can be executed remotely. The exploit has been published and may be used.
- CVE-2026-103056Critical
AiSOC versions 7.2.0 before 12.0.0 contain a command injection vulnerability in the actions service that builds CrowdStrike Real Time Response command strings by interpolating unescaped action parameters in crowdstrike_rtr.py and endpoint.py. Authenticated users can inject single quotes into file_path, path, script_name, or script_args parameters to break out of quoted arguments and execute arbitrary commands on managed endpoints with SYSTEM or root privileges.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Fix use-after free in init error and remove paths devm_blk_crypto_profile_init() registers a cleanup handler to run when the associated (platform-) device is being released. For UFS, the crypto private data and pointers are stored as part of the ufs_hba's data structure 'struct ufs_hba::crypto_profile'. This structure is allocated as part of the underlying ufshcd and therefore Scsi_host allocation. During driver release or during error handling in ufshcd_pltfrm_init(), this structure is released as part of ufshcd_dealloc_host() before the (platform-) device associated with the crypto call above is released. Once this device is released, the crypto cleanup code will run, using the just-released 'struct ufs_hba::crypto_profile'. This causes a use-after-free situation: Call trace: kfree+0x60/0x2d8 (P) kvfree+0x44/0x60 blk_crypto_profile_destroy_callback+0x28/0x70 devm_action_release+0x1c/0x30 release_nodes+0x6c/0x108 devres_release_all+0x98/0x100 device_unbind_cleanup+0x20/0x70 really_probe+0x218/0x2d0 In other words, the initialisation code flow is: platform-device probe ufshcd_pltfrm_init() ufshcd_alloc_host() scsi_host_alloc() allocation of struct ufs_hba creation of scsi-host devices devm_blk_crypto_profile_init() devm registration of cleanup handler using platform-device and during error handling of ufshcd_pltfrm_init() or during driver removal: ufshcd_dealloc_host() scsi_host_put() put_device(scsi-host) release of struct ufs_hba put_device(platform-device) crypto cleanup handler To fix this use-after free, change ufshcd_alloc_host() to register a devres action to automatically cleanup the underlying SCSI device on ufshcd destruction, without requiring explicit calls to ufshcd_dealloc_host(). This way: * the crypto profile and all other ufs_hba-owned resources are destroyed before SCSI (as they've been registered after) * a memleak is plugged in tc-dwc-g210-pci.c remove() as a side-effect * EXPORT_SYMBOL_GPL(ufshcd_dealloc_host) can be removed fully as it's not needed anymore * no future drivers using ufshcd_alloc_host() could ever forget adding the cleanup
Vulnerability data from NVD (NIST) · CISA KEV · EPSS