CVE-2025-38031
Description
In the Linux kernel, the following vulnerability has been resolved: padata: do not leak refcount in reorder_work A recent patch that addressed a UAF introduced a reference count leak: the parallel_data refcount is incremented unconditionally, regardless of the return value of queue_work(). If the work item is already queued, the incremented refcount is never decremented. Fix this by checking the return value of queue_work() and decrementing the refcount when necessary. Resolves: Unreferenced object 0xffff9d9f421e3d80 (size 192): comm "cryptomgr_probe", pid 157, jiffies 4294694003 hex dump (first 32 bytes): 80 8b cf 41 9f 9d ff ff b8 97 e0 89 ff ff ff ff ...A............ d0 97 e0 89 ff ff ff ff 19 00 00 00 1f 88 23 00 ..............#. backtrace (crc 838fb36): __kmalloc_cache_noprof+0x284/0x320 padata_alloc_pd+0x20/0x1e0 padata_alloc_shell+0x3b/0xa0 0xffffffffc040a54d cryptomgr_probe+0x43/0xc0 kthread+0xf6/0x1f0 ret_from_fork+0x2f/0x50 ret_from_fork_asm+0x1a/0x30
How to fix
- linux linux_kernel5.10.238, 5.15.185, 6.1.141, 6.6.93, 6.12.31, 6.14.9 or later
- git.kernel.org/stable/c/1a426abdf1c86882c9203dd8182f3b8274b89938
- git.kernel.org/stable/c/1c65ae4988714716101555fe2b9830e33136d6fb
- git.kernel.org/stable/c/5300e487487d7a2e3e1e6e9d8f03ed9452e4019e
- git.kernel.org/stable/c/584a729615fa92f4de45480efb7e569d14be1516
- git.kernel.org/stable/c/b9ad8e50e8589607e68e6c4cefa7f72bf35a2cb1
- git.kernel.org/stable/c/cceb15864e1612ebfbc10ec4e4dcd19a10c0056c
- git.kernel.org/stable/c/d6ebcde6d4ecf34f8495fb30516645db3aea8993
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| linux linux_kernel | 5.10.235 ≤ v < 5.10.238, 5.15.179 ≤ v < 5.15.185, 6.1.129 ≤ v < 6.1.141, 6.6.76 ≤ v < 6.6.93, 6.12.13 ≤ v < 6.12.31, 6.13.2 ≤ v < 6.14.9, 6.15 | 5.10.238, 5.15.185, 6.1.141, 6.6.93, 6.12.31, 6.14.9 |
| debian debian_linux | 11.0 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.