Junglewise Threat Intelligence

CVE-2025-21726: Linux Kernel use-after-free in padata reorder_work

CVE-2025-21726 · Severity: high · CVSS 7.8 · Published 2025-02-27

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability exists in the Linux kernel's padata framework, which is used for parallelizing CPU-intensive work like encryption. A race condition in how the system handles reordering tasks can lead to a system crash or potential unauthorized access. This could allow a local user to disrupt system operations or compromise data integrity. The issue has been resolved in recent kernel updates.

Technical details

A use-after-free (UAF) vulnerability exists in the padata infrastructure of the Linux kernel, specifically within the reorder_work mechanism. The flaw is rooted in a race condition where a parallel_data (pd) object can be freed by one process (e.g., crypto_del_alg) while a worker thread (invoke_padata_reorder) is still attempting to access it. This occurs because the reorder_work was queued without properly incrementing the reference count of the pd object. An attacker with local access could exploit this race condition to trigger a kernel crash or potentially execute arbitrary code. The fix involves ensuring the pd reference count is incremented before queuing reorder_work and decremented only after the work is completed.

Affected products

  • Linux Linux Kernel 5.4.19 to 5.5, 5.5.3 to 5.10.235, 5.11 to 5.15.79, 5.16 to 6.1.129, 6.2 to 6.6.76, 6.7 to 6.12.13, 6.13 to 6.13.2

Timeline

  • 2025-01-10: patched: Initial patch authored by Chen Ridong
  • 2025-02-27: advisory: CVE-2025-21726 published

References

Related threats