{"id":"CVE-2025-38584","revision":"8d28b5b19e104b11aedf7bcc7a5a62b7","records":[{"revision":"8d28b5b19e104b11aedf7bcc7a5a62b7","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2025-38584","aliases":[],"title":"padata: Fix pd UAF once and for all","description":"In the Linux kernel, the following vulnerability has been resolved:\n\npadata: Fix pd UAF once and for all\n\nThere is a race condition/UAF in padata_reorder that goes back\nto the initial commit.  A reference count is taken at the start\nof the process in padata_do_parallel, and released at the end in\npadata_serial_worker.\n\nThis reference count is (and only is) required for padata_replace\nto function correctly.  If padata_replace is never called then\nthere is no issue.\n\nIn the function padata_reorder which serves as the core of padata,\nas soon as padata is added to queue->serial.list, and the associated\nspin lock released, that padata may be processed and the reference\ncount on pd would go away.\n\nFix this by getting the next padata before the squeue->serial lock\nis released.\n\nIn order to make this possible, simplify padata_reorder by only\ncalling it once the next padata arrives.","state":0,"publishedAt":"2025-08-19T17:03:06.172+00:00","modifiedAt":"2026-10-15T22:02:26.071+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"include/linux/padata.h\",\n                        \"kernel/padata.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"16295bec6398a3eedc9377e1af6ff4c71b98c300\",\n                            \"lessThan\": \"a2048e475e22b13dc3e53d485b7e6e11464ed9a6\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"16295bec6398a3eedc9377e1af6ff4c71b98c300\",\n                            \"lessThan\": \"73f132e60857038416540c3599b1de6033d7575a\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"16295bec6398a3eedc9377e1af6ff4c71b98c300\",\n                            \"lessThan\": \"609e59193fc6d9dd323f1c6ae1fdd721f1c79680\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"16295bec6398a3eedc9377e1af6ff4c71b98c300\",\n                            \"lessThan\": \"a11a12a9880ab37342b73c93cfe1a3ada02ff0db\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"16295bec6398a3eedc9377e1af6ff4c71b98c300\",\n                            \"lessThan\": \"f231d5d001ec75f5886c02d496a4c79edc383d45\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"16295bec6398a3eedc9377e1af6ff4c71b98c300\",\n                            \"lessThan\": \"dbe3e911a59bda6de96e7cae387ff882c2c177fa\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"16295bec6398a3eedc9377e1af6ff4c71b98c300\",\n                            \"lessThan\": \"cdf79bd2e1ecb3cc75631c73d8f4149be6019a52\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"16295bec6398a3eedc9377e1af6ff4c71b98c300\",\n                            \"lessThan\": \"71203f68c7749609d7fc8ae6ad054bdedeb24f91\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"include/linux/padata.h\",\n                        \"kernel/padata.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"2.6.34\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"2.6.34\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.258\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.209\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.175\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.140\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.86\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.15.10\",\n                            \"lessThanOrEqual\": \"6.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.16.1\",\n                            \"lessThanOrEqual\": \"6.16.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.17\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/a2048e475e22b13dc3e53d485b7e6e11464ed9a6","https://git.kernel.org/stable/c/73f132e60857038416540c3599b1de6033d7575a","https://git.kernel.org/stable/c/609e59193fc6d9dd323f1c6ae1fdd721f1c79680","https://git.kernel.org/stable/c/a11a12a9880ab37342b73c93cfe1a3ada02ff0db","https://git.kernel.org/stable/c/f231d5d001ec75f5886c02d496a4c79edc383d45","https://git.kernel.org/stable/c/dbe3e911a59bda6de96e7cae387ff882c2c177fa","https://git.kernel.org/stable/c/cdf79bd2e1ecb3cc75631c73d8f4149be6019a52","https://git.kernel.org/stable/c/71203f68c7749609d7fc8ae6ad054bdedeb24f91"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-38584","license":"CVE Program Terms of Use","key":"cve-program:CVE-2025-38584","identifiers":["CVE-2025-38584"]},"retained":false,"historicalAffected":[]}],"coverage":[]}