CVE-2025-21726: padata: avoid UAF for reorder_work
In the Linux kernel, the following vulnerability has been resolved:
padata: avoid UAF for reorderwork
Although the previous patch can avoid ps and ps UAF for doserial, it can not avoid potential UAF issue for reorderwork. This issue can happen just as below:
cryptorequest cryptorequest cryptodelalg padatadoserial ... padatareorder // processes all remaining // requests then breaks while (1) { if (!padata) break; ... }
padatadoserial // new request added listadd // sees the new request queuework(reorderwork) padatareorder queueworkon(squeue->work) ...
<kworker context> padataserialworker // completes new request, // no more outstanding // requests
cryptodelalg // free pd
<kworker context> invokepadatareorder // UAF of pd
To avoid UAF for 'reorderwork', get 'pd' ref before put 'reorderwork' into the 'serialwq' and put 'pd' ref until the 'serialwq' finish.
Other sources
In the Linux kernel, the following vulnerability has been resolved:
padata: avoid UAF for reorderwork
Although the previous patch can avoid ps and ps UAF for doserial, it can not avoid potential UAF issue for reorderwork. This issue can happen just as below:
cryptorequest cryptorequest cryptodelalg padatadoserial ... padatareorder // processes all remaining // requests then breaks while (1) { if (!padata) break; ... }
padatadoserial // new request added listadd // sees the new request queuework(reorderwork) padatareorder queueworkon(squeue-work) ...
kworker context padataserialworker // completes new request, // no more outstanding // requests
cryptodelalg // free pd
kworker context invokepadatareorder // UAF of pd
To avoid UAF for 'reorderwork', get 'pd' ref before put 'reorderwork' into the 'serialwq' and put 'pd' ref until the 'serialwq' finish.
— IBM
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-21726?
CVE-2025-21726 has a medium severity rating due to its potential to cause a use-after-free condition in the Linux kernel.
How do I fix CVE-2025-21726?
To fix CVE-2025-21726, ensure that you update to the latest version of the Linux kernel that includes the relevant patches.
What systems are affected by CVE-2025-21726?
CVE-2025-21726 affects all versions of the Linux kernel prior to the patched releases.
What type of vulnerability is CVE-2025-21726?
CVE-2025-21726 is a use-after-free vulnerability in the padata subsystem of the Linux kernel.
What could happen if CVE-2025-21726 is exploited?
Exploitation of CVE-2025-21726 could potentially lead to arbitrary code execution or a system crash.