CVE-2025-38031

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

padata: do not leak refcount in reorder_work

A recent patch that addressed a UAF introduced a reference count leak:

the parallel_data refcount is incremented unconditionally, regardless

of the return value of queue_work(). If the work item is already queued,

the incremented refcount is never decremented.

Fix this by checking the return value of queue_work() and decrementing

the refcount when necessary.

Resolves:

Unreferenced object 0xffff9d9f421e3d80 (size 192):

comm "cryptomgr_probe", pid 157, jiffies 4294694003

hex dump (first 32 bytes):

80 8b cf 41 9f 9d ff ff b8 97 e0 89 ff ff ff ff ...A............

d0 97 e0 89 ff ff ff ff 19 00 00 00 1f 88 23 00 ..............#.

backtrace (crc 838fb36):

__kmalloc_cache_noprof+0x284/0x320

padata_alloc_pd+0x20/0x1e0

padata_alloc_shell+0x3b/0xa0

0xffffffffc040a54d

cryptomgr_probe+0x43/0xc0

kthread+0xf6/0x1f0

ret_from_fork+0x2f/0x50

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References