Executive brief
A vulnerability has been identified in the Linux kernel's padata infrastructure, which handles parallel processing of data. A race condition could allow a local attacker to cause a system crash or potentially execute unauthorized code by exploiting a 'use-after-free' memory error. This issue primarily affects system stability and the integrity of kernel operations.
Technical details
A race condition exists in the padata_reorder function of the Linux kernel's padata infrastructure. The vulnerability is a use-after-free (UAF) rooted in how reference counts for parallel_data (pd) objects are managed. Specifically, when a padata object is added to the serial queue and its spinlock is released, the object can be processed immediately, potentially causing the reference count on the associated 'pd' structure to drop to zero and be freed while still in use by the reorder logic. The fix involves ensuring the next padata object is retrieved before the serial lock is released, maintaining the validity of the reference count. This affects versions dating back to the initial commit of the padata interface.
Affected products
- Linux Linux Kernel 2.6.34 to 6.15.10, 6.16 to 6.16.1
Timeline
- 2025-08-19: disclosed
- 2025-08-19: advisory
- 2025-05-24: patched: Initial patch authored by Herbert Xu
References
- https://git.kernel.org/stable/c/71203f68c7749609d7fc8ae6ad054bdedeb24f91
- https://git.kernel.org/stable/c/a11a12a9880ab37342b73c93cfe1a3ada02ff0db
- https://git.kernel.org/stable/c/cdf79bd2e1ecb3cc75631c73d8f4149be6019a52
- https://git.kernel.org/stable/c/dbe3e911a59bda6de96e7cae387ff882c2c177fa
- https://git.kernel.org/stable/c/f231d5d001ec75f5886c02d496a4c79edc383d45