Skip to content
Heist/ feed
High

padata: fix UAF in padata_reorder

Type: advisorySource: Official CVE List1 source record

In the Linux kernel, the following vulnerability has been resolved: padata: fix UAF in padata_reorder A bug was found when run ltp test: BUG: KASAN: slab-use-after-free in padata_find_next+0x29/0x1a0 Read of size 4 at addr ffff88bbfe003524 by task kworker/u113:2/3039206 CPU: 0 PID: 3039206 Comm: kworker/u113:2 Kdump: loaded Not tainted 6.6.0+ Workqueue: pdecrypt_parallel padata_parallel_worker Call Trace: dump_stack_lvl+0x32/0x50 print_address_description.constprop.0+0x6b/0x3d0 print_report+0xdd/0x2c0 kasan_report+0xa5/0xd0 padata_find_next+0x29/0x1a0 padata_reorder+0x131/0x220 padata_parallel_worker+0x3d/0xc0 process_one_work+0x2ec/0x5a0 If 'mdelay(10)' is added before calling 'padata_find_next' in the 'padata_reorder' function, this issue could be reproduced easily with ltp test (pcrypt_aead01). This can be explained as bellow: pcrypt_aead_encrypt ... padata_do_parallel refcount_inc(&pd->refcnt); // add refcnt ... padata_do_serial padata_reorder // pd while (1) { padata_find_next(pd, true); // using pd queue_work_on ... padata_serial_worker crypto_del_alg padata_put_pd_cnt // sub refcnt padata_free_shell padata_put_pd(ps->pd); // pd is freed // loop again, but pd is freed // call padata_find_next, UAF } In the padata_reorder function, when it loops in 'while', if the alg is deleted, the refcnt may be decreased to 0 before entering 'padata_find_next', which leads to UAF. As mentioned in [1], do_serial is supposed to be called with BHs disabled and always happen under RCU pro

Announced Source revision 1
Original source ↗

CVE-2025-21727

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2025-21727

Linux

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Linux

Source reference: /containers/cna/affected/1/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "b128a30409356df65f1a51cff3eb986cac8cfedc",
        "lessThan": "f78170bee51469734b1a306a74fc5f777bb22ba6",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "b128a30409356df65f1a51cff3eb986cac8cfedc",
        "lessThan": "f3e0b9f790f8e8065d59e67b565a83154d9f3079",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "b128a30409356df65f1a51cff3eb986cac8cfedc",
        "lessThan": "0ae2f332cfd2d74cf3ce344ec9938cf3e29c3ccd",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "b128a30409356df65f1a51cff3eb986cac8cfedc",
        "lessThan": "bbccae982e9fa1d7abcb23a5ec81cb0ec883f7de",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "b128a30409356df65f1a51cff3eb986cac8cfedc",
        "lessThan": "573ac9c70bf7885dc85d82fa44550581bfc3b738",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "b128a30409356df65f1a51cff3eb986cac8cfedc",
        "lessThan": "80231f069240d52e98b6a317456c67b2eafd0781",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "b128a30409356df65f1a51cff3eb986cac8cfedc",
        "lessThan": "e01780ea4661172734118d2a5f41bc9720765668",
        "versionType": "git"
      }
    ],
    "programFiles": [
      "kernel/padata.c"
    ],
    "defaultStatus": "unaffected"
  },
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "5.4"
      },
      {
        "status": "unaffected",
        "version": "0",
        "lessThan": "5.4",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "5.10.235",
        "versionType": "semver",
        "lessThanOrEqual": "5.10.*"
      },
      {
        "status": "unaffected",
        "version": "5.15.179",
        "versionType": "semver",
        "lessThanOrEqual": "5.15.*"
      },
      {
        "status": "unaffected",
        "version": "6.1.129",
        "versionType": "semver",
        "lessThanOrEqual": "6.1.*"
      },
      {
        "status": "unaffected",
        "version": "6.6.76",
        "versionType": "semver",
        "lessThanOrEqual": "6.6.*"
      },
      {
        "status": "unaffected",
        "version": "6.12.13",
        "versionType": "semver",
        "lessThanOrEqual": "6.12.*"
      },
      {
        "status": "unaffected",
        "version": "6.13.2",
        "versionType": "semver",
        "lessThanOrEqual": "6.13.*"
      },
      {
        "status": "unaffected",
        "version": "6.14",
        "versionType": "original_commit_for_fix",
        "lessThanOrEqual": "*"
      }
    ],
    "programFiles": [
      "kernel/padata.c"
    ],
    "defaultStatus": "affected"
  }
]
Related CVEs
CVE-2025-21727

Source reference: /cveMetadata/cveId

Publisher severity

high

Source reference: /containers/cna/metrics

Event
#26924 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement