CVE-2025-38584

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

padata: Fix pd UAF once and for all

There is a race condition/UAF in padata_reorder that goes back

to the initial commit. A reference count is taken at the start

of the process in padata_do_parallel, and released at the end in

padata_serial_worker.

This reference count is (and only is) required for padata_replace

to function correctly. If padata_replace is never called then

there is no issue.

In the function padata_reorder which serves as the core of padata,

as soon as padata is added to queue->serial.list, and the associated

spin lock released, that padata may be processed and the reference

count on pd would go away.

Fix this by getting the next padata before the squeue->serial lock

is released.

In order to make this possible, simplify padata_reorder by only

calling it once the next padata arrives.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References