CVE-2025-21726

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-21726
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-21726.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2025-21726
Downstream
Related
Published
2025-02-27T02:07:32.861Z
Modified
2026-05-07T04:17:11.712953Z
Severity
  • 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
padata: avoid UAF for reorder_work
Details

In the Linux kernel, the following vulnerability has been resolved:

padata: avoid UAF for reorder_work

Although the previous patch can avoid ps and ps UAF for doserial, it can not avoid potential UAF issue for reorder_work. This issue can happen just as below:

cryptorequest cryptorequest cryptodelalg padatadoserial ... padata_reorder // processes all remaining // requests then breaks while (1) { if (!padata) break; ... }

            padata_do_serial
              // new request added
              list_add
// sees the new request
queue_work(reorder_work)
              padata_reorder
                queue_work_on(squeue->work)

...

            <kworker context>
            padata_serial_worker
            // completes new request,
            // no more outstanding
            // requests

                        crypto_del_alg
                          // free pd

<kworker context> invokepadatareorder // UAF of pd

To avoid UAF for 'reorderwork', get 'pd' ref before put 'reorderwork' into the 'serialwq' and put 'pd' ref until the 'serialwq' finish.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/21xxx/CVE-2025-21726.json",
    "cna_assigner": "Linux"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
bbefa1dd6a6d53537c11624752219e39959d04fb
Fixed
f4f1b1169fc3694f9bc3e28c6c68dbbf4cc744c0
Fixed
4c6209efea2208597dbd3e52dc87a0d1a8f2dbe1
Fixed
7000507bb0d2ceb545c0a690e0c707c897d102c2
Fixed
6f45ef616775b0ce7889b0f6077fc8d681ab30bc
Fixed
8ca38d0ca8c3d30dd18d311f1a7ec5cb56972cac
Fixed
a54091c24220a4cd847d5b4f36d678edacddbaf0
Fixed
dd7d37ccf6b11f3d95e797ebe4e9e886d0332600
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
b4c8ed0bf977760a206997b6429a7ac91978f440
Last affected
e43d65719527043f1ef79ecba9d4ede58cbc7ffe

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-21726.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
5.6.0
Fixed
5.10.235
Type
ECOSYSTEM
Events
Introduced
5.11.0
Fixed
5.15.179
Type
ECOSYSTEM
Events
Introduced
5.16.0
Fixed
6.1.129
Type
ECOSYSTEM
Events
Introduced
6.2.0
Fixed
6.6.76
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.12.13
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.13.2

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-21726.json"