CVE-2025-21786: workqueue: Put the pwq after detaching the rescuer from the pool

Published Feb 27, 2025
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

workqueue: Put the pwq after detaching the rescuer from the pool

The commit 68f83057b913("workqueue: Reap workers via kthreadstop() and remove detachcompletion") adds code to reap the normal workers but mistakenly does not handle the rescuer and also removes the code waiting for the rescuer in putunboundpool(), which caused a use-after-free bug reported by Cheung Wall.

To avoid the use-after-free bug, the pool’s reference must be held until the detachment is complete. Therefore, move the code that puts the pwq after detaching the rescuer from the pool.

Affected Software

13 affected components
Linux Linux kernel
Linux Linux kernel<6.12.16
Linux Linux kernel>=6.13<6.13.4
Microsoft azl3 kernel 6.6.117.1-1
Microsoft azl3 kernel 6.6.104.2-4
Microsoft azl3 kernel 6.6.96.2-2
Microsoft azl3 kernel 6.6.112.1-2
Microsoft azl3 kernel 6.6.96.2-1
Microsoft cbl2 kernel 5.15.186.1-1
IBM Verify Identity Access<=11.0 - 11.0.2
IBM Security Verify Access<=10.0 - 10.0.9.1
IBM Verify Identity Access Container<=11.0 - 11.0.2
IBM Security Verify Access Container<=10.0 - 10.0.9.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade Linux kernel to a version that resolves this vulnerability.

    Patch 68f83057b913

Event History

Feb 27, 2025
CVE Published
via MITRE·02:18 AM
Data Sourced
via MITRE·02:18 AM
Description
Data Sourced
via Red Hat·03:04 AM
DescriptionSeverityAffected Software
Sep 4, 2025
Data Sourced
via Microsoft·02:25 AM
DescriptionSeverityWeakness
Data Sourced
via Microsoft·02:25 AM
Affected Software
Updated
via Microsoft·02:25 AM
Affected Software
Updated
via Microsoft·02:25 AM
SeverityAffected Software
Updated
via Microsoft·02:25 AM
DescriptionSeverity
Jul 8, 2026
Data Sourced
via IBM·12:00 AM
DescriptionAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2025-21786?

The severity of CVE-2025-21786 is categorized as medium, highlighting a potential impact on system stability.

2

What systems are affected by CVE-2025-21786?

CVE-2025-21786 affects the Linux kernel, specifically versions prior to the fix implemented in the related commits.

3

How do I fix CVE-2025-21786?

To fix CVE-2025-21786, update your Linux kernel to the latest version that contains the necessary patches.

4

What mitigation strategies exist for CVE-2025-21786?

Mitigation strategies for CVE-2025-21786 include applying kernel patches and avoiding the use of affected kernel configurations.

5

Was there a patch released for CVE-2025-21786?

Yes, patches for CVE-2025-21786 were released in the kernel commits that address the vulnerability.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203