VYPR
← All advisories
High severity7.8NVD Advisory· Published Feb 27, 2025· Updated May 12, 2026

CVE-2025-21726

CVE-2025-21726

Description

In the Linux kernel, the following vulnerability has been resolved:

padata: avoid UAF for reorder_work

Although the previous patch can avoid ps and ps UAF for _do_serial, it can not avoid potential UAF issue for reorder_work. This issue can happen just as below:

crypto_request crypto_request crypto_del_alg padata_do_serial ... padata_reorder // processes all remaining // requests then breaks while (1) { if (!padata) break; ... }

padata_do_serial // new request added list_add // sees the new request queue_work(reorder_work) padata_reorder queue_work_on(squeue->work) ...

padata_serial_worker // completes new request, // no more outstanding // requests

crypto_del_alg // free pd

invoke_padata_reorder // UAF of pd

To avoid UAF for 'reorder_work', get 'pd' ref before put 'reorder_work' into the 'serial_wq' and put 'pd' ref until the 'serial_wq' finish.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

A use-after-free vulnerability in the Linux kernel's padata subsystem, where reorder_work can access freed memory.

CVE-2025-21726 is a use-after-free (UAF) vulnerability in the Linux kernel's padata subsystem. The root cause is a race condition where the reorder_work work item can be queued on the serial_wq after the parallel data (pd) structure has been freed during driver removal. This occurs because the existing fix for _do_serial did not protect the reorder_work path. The race window is opened when a new request is added after the reorder loop finishes but before the work item is processed, leading to the work item accessing freed memory [1][2].

Exploitation

An attacker can trigger this vulnerability by orchestrating a sequence of operations: initiating padata requests, removing the cryptographic algorithm (e.g., via crypto_del_alg) while concurrent padata operations are in flight, and having the kernel's workqueue execute the stale reorder_work. This scenario requires local access to the system and the ability to trigger padata operations and module unloading. The attack surface is present on any system using the padata framework, such as those processing cryptographic operations like AES-GCM or other symmetric ciphers via AF_ALG or similar interfaces [1][2].

Impact

Successful exploitation results in a use-after-free condition, which can lead to memory corruption, system crash (denial of service), or potentially privilege escalation. The CVSS v3 score of 7.8 (High) reflects the high impact on confidentiality, integrity, and availability, although exploitation requires local access and complex preconditions. The vulnerability is listed in Siemens' advisory for SIMATIC S7-1500 TM MFP GNU/Linux subsystem and affects many other industrial and embedded systems [1].

Mitigation

The fix, introduced in the Linux kernel commit series, ensures that reorder_work holds a reference to the pd structure before it is queued on the serial_wq, and releases that reference only after the work completes. This prevents the work item from accessing freed memory. Users should apply the latest kernel stable updates that include commits such as 6f45ef616775 or a54091c24220. For systems that cannot be immediately updated, limiting access to system administration capabilities can reduce risk [1][2].

References
  1. SSA-265688
  2. Making sure you're not a bot!

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

265

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

10

News mentions

0

No linked articles in our index yet.