In the Linux kernel, the following vulnerability has been resolved:
padata: avoid UAF for reorder_work
Although the previous patch can avoid ps and ps UAF for doserial, it can not avoid potential UAF issue for reorder_work. This issue can happen just as below:
cryptorequest cryptorequest cryptodelalg padatadoserial ... padata_reorder // processes all remaining // requests then breaks while (1) { if (!padata) break; ... }
padata_do_serial
// new request added
list_add
// sees the new request
queue_work(reorder_work)
padata_reorder
queue_work_on(squeue->work)
...
<kworker context>
padata_serial_worker
// completes new request,
// no more outstanding
// requests
crypto_del_alg
// free pd
<kworker context> invokepadatareorder // UAF of pd
To avoid UAF for 'reorderwork', get 'pd' ref before put 'reorderwork' into the 'serialwq' and put 'pd' ref until the 'serialwq' finish.
[
{
"deprecated": false,
"target": {
"file": "kernel/padata.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"18467639472640021179171110221657974453",
"3425897868794897617344594549601766617",
"111437994621689596548600281958155511907",
"16734956855649622206056636258639068997",
"273377712596544384139292493960594602917",
"240368222501851246265659207448840795813",
"252336677408064533376350968221275809032",
"11291574556132109223418741700596329374",
"66286073811003744588180384701590384462"
]
},
"id": "CVE-2025-21726-005b1feb",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a54091c24220a4cd847d5b4f36d678edacddbaf0",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "kernel/padata.c",
"function": "invoke_padata_reorder"
},
"digest": {
"length": 160.0,
"function_hash": "119537585394449159290302163524952006186"
},
"id": "CVE-2025-21726-00e1b2b5",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6f45ef616775b0ce7889b0f6077fc8d681ab30bc",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "kernel/padata.c",
"function": "invoke_padata_reorder"
},
"digest": {
"length": 160.0,
"function_hash": "119537585394449159290302163524952006186"
},
"id": "CVE-2025-21726-168d713a",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f4f1b1169fc3694f9bc3e28c6c68dbbf4cc744c0",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "kernel/padata.c",
"function": "padata_reorder"
},
"digest": {
"length": 721.0,
"function_hash": "43881700288227972438475046685530432106"
},
"id": "CVE-2025-21726-1a188524",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6f45ef616775b0ce7889b0f6077fc8d681ab30bc",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "kernel/padata.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"18467639472640021179171110221657974453",
"3425897868794897617344594549601766617",
"111437994621689596548600281958155511907",
"16734956855649622206056636258639068997",
"273377712596544384139292493960594602917",
"240368222501851246265659207448840795813",
"252336677408064533376350968221275809032",
"11291574556132109223418741700596329374",
"66286073811003744588180384701590384462"
]
},
"id": "CVE-2025-21726-2c8f5e86",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dd7d37ccf6b11f3d95e797ebe4e9e886d0332600",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "kernel/padata.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"18467639472640021179171110221657974453",
"3425897868794897617344594549601766617",
"111437994621689596548600281958155511907",
"16734956855649622206056636258639068997",
"273377712596544384139292493960594602917",
"240368222501851246265659207448840795813",
"252336677408064533376350968221275809032",
"11291574556132109223418741700596329374",
"66286073811003744588180384701590384462"
]
},
"id": "CVE-2025-21726-2c9626bb",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8ca38d0ca8c3d30dd18d311f1a7ec5cb56972cac",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "kernel/padata.c",
"function": "padata_reorder"
},
"digest": {
"length": 721.0,
"function_hash": "43881700288227972438475046685530432106"
},
"id": "CVE-2025-21726-2d925fe5",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4c6209efea2208597dbd3e52dc87a0d1a8f2dbe1",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "kernel/padata.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"18467639472640021179171110221657974453",
"3425897868794897617344594549601766617",
"111437994621689596548600281958155511907",
"16734956855649622206056636258639068997",
"273377712596544384139292493960594602917",
"240368222501851246265659207448840795813",
"252336677408064533376350968221275809032",
"11291574556132109223418741700596329374",
"66286073811003744588180384701590384462"
]
},
"id": "CVE-2025-21726-55222510",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4c6209efea2208597dbd3e52dc87a0d1a8f2dbe1",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "kernel/padata.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"18467639472640021179171110221657974453",
"3425897868794897617344594549601766617",
"111437994621689596548600281958155511907",
"16734956855649622206056636258639068997",
"273377712596544384139292493960594602917",
"240368222501851246265659207448840795813",
"252336677408064533376350968221275809032",
"11291574556132109223418741700596329374",
"66286073811003744588180384701590384462"
]
},
"id": "CVE-2025-21726-56988630",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6f45ef616775b0ce7889b0f6077fc8d681ab30bc",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "kernel/padata.c",
"function": "padata_reorder"
},
"digest": {
"length": 721.0,
"function_hash": "43881700288227972438475046685530432106"
},
"id": "CVE-2025-21726-5a072e36",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7000507bb0d2ceb545c0a690e0c707c897d102c2",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "kernel/padata.c",
"function": "padata_reorder"
},
"digest": {
"length": 721.0,
"function_hash": "43881700288227972438475046685530432106"
},
"id": "CVE-2025-21726-5a381f4c",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a54091c24220a4cd847d5b4f36d678edacddbaf0",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "kernel/padata.c",
"function": "invoke_padata_reorder"
},
"digest": {
"length": 160.0,
"function_hash": "119537585394449159290302163524952006186"
},
"id": "CVE-2025-21726-70925360",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8ca38d0ca8c3d30dd18d311f1a7ec5cb56972cac",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "kernel/padata.c",
"function": "padata_reorder"
},
"digest": {
"length": 721.0,
"function_hash": "43881700288227972438475046685530432106"
},
"id": "CVE-2025-21726-78031c15",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8ca38d0ca8c3d30dd18d311f1a7ec5cb56972cac",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "kernel/padata.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"18467639472640021179171110221657974453",
"3425897868794897617344594549601766617",
"111437994621689596548600281958155511907",
"16734956855649622206056636258639068997",
"273377712596544384139292493960594602917",
"240368222501851246265659207448840795813",
"252336677408064533376350968221275809032",
"11291574556132109223418741700596329374",
"66286073811003744588180384701590384462"
]
},
"id": "CVE-2025-21726-822b517a",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f4f1b1169fc3694f9bc3e28c6c68dbbf4cc744c0",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "kernel/padata.c",
"function": "padata_reorder"
},
"digest": {
"length": 721.0,
"function_hash": "43881700288227972438475046685530432106"
},
"id": "CVE-2025-21726-90586155",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f4f1b1169fc3694f9bc3e28c6c68dbbf4cc744c0",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "kernel/padata.c",
"function": "invoke_padata_reorder"
},
"digest": {
"length": 160.0,
"function_hash": "119537585394449159290302163524952006186"
},
"id": "CVE-2025-21726-906c2e64",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7000507bb0d2ceb545c0a690e0c707c897d102c2",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "kernel/padata.c",
"function": "invoke_padata_reorder"
},
"digest": {
"length": 160.0,
"function_hash": "119537585394449159290302163524952006186"
},
"id": "CVE-2025-21726-93f053eb",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a54091c24220a4cd847d5b4f36d678edacddbaf0",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "kernel/padata.c",
"function": "invoke_padata_reorder"
},
"digest": {
"length": 160.0,
"function_hash": "119537585394449159290302163524952006186"
},
"id": "CVE-2025-21726-987729e2",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4c6209efea2208597dbd3e52dc87a0d1a8f2dbe1",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "kernel/padata.c",
"function": "invoke_padata_reorder"
},
"digest": {
"length": 160.0,
"function_hash": "119537585394449159290302163524952006186"
},
"id": "CVE-2025-21726-b9db67fd",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dd7d37ccf6b11f3d95e797ebe4e9e886d0332600",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "kernel/padata.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"18467639472640021179171110221657974453",
"3425897868794897617344594549601766617",
"111437994621689596548600281958155511907",
"16734956855649622206056636258639068997",
"273377712596544384139292493960594602917",
"240368222501851246265659207448840795813",
"252336677408064533376350968221275809032",
"11291574556132109223418741700596329374",
"66286073811003744588180384701590384462"
]
},
"id": "CVE-2025-21726-bf074944",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7000507bb0d2ceb545c0a690e0c707c897d102c2",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "kernel/padata.c",
"function": "padata_reorder"
},
"digest": {
"length": 721.0,
"function_hash": "43881700288227972438475046685530432106"
},
"id": "CVE-2025-21726-d3a223a3",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dd7d37ccf6b11f3d95e797ebe4e9e886d0332600",
"signature_version": "v1"
}
]