{"id":"CVE-2025-38584","title":"In the Linux kernel, the following vulnerability has been resolved:\n\npadata: Fix pd UAF once and for all\n\nThere is a race condition/UAF in padata_reorder that goes back\nto the initial commit","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\npadata: Fix pd UAF once and for all\n\nThere is a race condition/UAF in padata_reorder that goes back\nto the initial commit.  A reference count is taken at the start\nof t…","severity":"high","cvss":7,"cvssVector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-416"],"vendor":"linux","product":"linux_kernel","affected":["linux_kernel >= 2.6.34, < 6.15.10","linux_kernel >= 6.16, < 6.16.1"],"patched":["linux_kernel 6.16.1"],"published":"2025-08-19","updated":"2026-10-15","sourceUpdated":"2026-10-15T22:18:46.183","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-38584","references":[{"url":"https://git.kernel.org/stable/c/609e59193fc6d9dd323f1c6ae1fdd721f1c79680","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/71203f68c7749609d7fc8ae6ad054bdedeb24f91","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/73f132e60857038416540c3599b1de6033d7575a","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a11a12a9880ab37342b73c93cfe1a3ada02ff0db","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a2048e475e22b13dc3e53d485b7e6e11464ed9a6","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cdf79bd2e1ecb3cc75631c73d8f4149be6019a52","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/dbe3e911a59bda6de96e7cae387ff882c2c177fa","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f231d5d001ec75f5886c02d496a4c79edc383d45","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-784472.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"tags":["nvd","cve.org"],"epss":0.00182,"epssPercentile":0.07756,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-15T21:51:57.371948Z"},"ingestedAt":"2026-10-15T03:30:12.818Z","slug":"CVE-2025-38584","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\npadata: Fix pd UAF once and for all\n\nThere is a race condition/UAF in padata_reorder that goes back\nto the initial commit.  A reference count is taken at the start\nof the process in padata_do_parallel, and released at the end in\npadata_serial_worker.\n\nThis reference count is (and only is) required for padata_replace\nto function correctly.  If padata_replace is never called then\nthere is no issue.\n\nIn the function padata_reorder which serves as the core of padata,\nas soon as padata is added to queue->serial.list, and the associated\nspin lock released, that padata may be processed and the reference\ncount on pd would go away.\n\nFix this by getting the next padata before the squeue->serial lock\nis released.\n\nIn order to make this possible, simplify padata_reorder by only\ncalling it once the next padata arrives.\n\n## Affected\n\n- `linux_kernel >= 2.6.34, < 6.15.10`\n- `linux_kernel >= 6.16, < 6.16.1`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `linux_kernel 6.16.1`","depth":"twilight","depthScore":39,"depthScoreParts":{"impact":38.5,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}