Fixed
Created: Aug 19, 2025
Updated: May 31, 2026
Resolved Date: May 31, 2026
Found In Version: 10.25.33.1
Fix Version: 10.25.33.10
Severity: Standard
Applicable for: Wind River Linux LTS 25
Component/s: Kernel
In the Linux kernel, the following vulnerability has been resolved:EOL][EOL]padata: Fix pd UAF once and for all[EOL][EOL]There is a race condition/UAF in padata_reorder that goes back[EOL]to the initial commit. A reference count is taken at the start[EOL]of the process in padata_do_parallel, and released at the end in[EOL]padata_serial_worker.[EOL][EOL]This reference count is (and only is) required for padata_replace[EOL]to function correctly. If padata_replace is never called then[EOL]there is no issue.[EOL][EOL]In the function padata_reorder which serves as the core of padata,[EOL]as soon as padata is added to queue->serial.list, and the associated[EOL]spin lock released, that padata may be processed and the reference[EOL]count on pd would go away.[EOL][EOL]Fix this by getting the next padata before the squeue->serial lock[EOL]is released.[EOL][EOL]In order to make this possible, simplify padata_reorder by only[EOL]calling it once the next padata arrives.
CREATE(Triage):(User=lchen-cn) [CVE-2025-38584 (https://nvd.nist.gov/vuln/detail/CVE-2025-38584)
