CVE-2025-38584: padata: Fix pd UAF once and for all

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-08-19 · updated 2026-10-15
Weakness: CWE-416

Description

In the Linux kernel, the following vulnerability has been resolved: padata: Fix pd UAF once and for all There is a race condition/UAF in padata_reorder that goes back to the initial commit. A reference count is taken at the start of the process in padata_do_parallel, and released at the end in padata_serial_worker. This reference count is (and only is) required for padata_replace to function correctly. If padata_replace is never called then there is no issue. In the function padata_reorder which serves as the core of padata, as soon as padata is added to queue->serial.list, and the associated spin lock released, that padata may be processed and the reference count on pd would go away. Fix this by getting the next padata before the squeue->serial lock is released. In order to make this possible, simplify padata_reorder by only calling it once the next padata arrives.

Affected products

Linux kernel: from 2.6.34 before 6.15.10; from 6.16 before 6.16.1 — fixed in 6.15.10, 6.16.1

How to fix

Upgrade to a fixed version: Linux kernel 6.15.10, 6.16.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-38584 or the next vulnerability affects your stack