---
id: CVE-2025-38584
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  padata: Fix pd UAF once and for all

  There is a race condition/UAF in padata_reorder that goes back
  to the initial commit
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  padata: Fix pd UAF once and for all

  There is a race condition/UAF in padata_reorder that goes back
  to the initial commit.  A reference count is taken at the start
  of t…
severity: high
cvss: 7
cvssVector: 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-416
vendor: linux
product: linux_kernel
affected:
  - 'linux_kernel >= 2.6.34, < 6.15.10'
  - 'linux_kernel >= 6.16, < 6.16.1'
patched:
  - linux_kernel 6.16.1
published: '2025-08-19'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T22:18:46.183'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-38584'
references:
  - url: 'https://git.kernel.org/stable/c/609e59193fc6d9dd323f1c6ae1fdd721f1c79680'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/71203f68c7749609d7fc8ae6ad054bdedeb24f91'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/73f132e60857038416540c3599b1de6033d7575a'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/a11a12a9880ab37342b73c93cfe1a3ada02ff0db'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/a2048e475e22b13dc3e53d485b7e6e11464ed9a6'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/cdf79bd2e1ecb3cc75631c73d8f4149be6019a52'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/dbe3e911a59bda6de96e7cae387ff882c2c177fa'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/f231d5d001ec75f5886c02d496a4c79edc383d45'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-784472.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
tags:
  - nvd
  - cve.org
epss: 0.00182
epssPercentile: 0.07756
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-15T21:51:57.371948Z'
ingestedAt: '2026-10-15T03:30:12.818Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

padata: Fix pd UAF once and for all

There is a race condition/UAF in padata_reorder that goes back
to the initial commit.  A reference count is taken at the start
of the process in padata_do_parallel, and released at the end in
padata_serial_worker.

This reference count is (and only is) required for padata_replace
to function correctly.  If padata_replace is never called then
there is no issue.

In the function padata_reorder which serves as the core of padata,
as soon as padata is added to queue->serial.list, and the associated
spin lock released, that padata may be processed and the reference
count on pd would go away.

Fix this by getting the next padata before the squeue->serial lock
is released.

In order to make this possible, simplify padata_reorder by only
calling it once the next padata arrives.

## Affected

- `linux_kernel >= 2.6.34, < 6.15.10`
- `linux_kernel >= 6.16, < 6.16.1`

## Remediation

Upgrade past the affected range:

- `linux_kernel 6.16.1`