CVE-2025-38584

{"id": "CVE-2025-38584", "cveTags": [], "metrics": {}, "published": "2025-08-19T17:15:35.723", "references": [{"url": "https://git.kernel.org/stable/c/71203f68c7749609d7fc8ae6ad054bdedeb24f91", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/cdf79bd2e1ecb3cc75631c73d8f4149be6019a52", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/dbe3e911a59bda6de96e7cae387ff882c2c177fa", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Awaiting Analysis", "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\npadata: Fix pd UAF once and for all\n\nThere is a race condition/UAF in padata_reorder that goes back\nto the initial commit. A reference count is taken at the start\nof the process in padata_do_parallel, and released at the end in\npadata_serial_worker.\n\nThis reference count is (and only is) required for padata_replace\nto function correctly. If padata_replace is never called then\nthere is no issue.\n\nIn the function padata_reorder which serves as the core of padata,\nas soon as padata is added to queue->serial.list, and the associated\nspin lock released, that padata may be processed and the reference\ncount on pd would go away.\n\nFix this by getting the next padata before the squeue->serial lock\nis released.\n\nIn order to make this possible, simplify padata_reorder by only\ncalling it once the next padata arrives."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: padata: Arregla pd UAF de una vez por todas Hay una condici\u00f3n de ejecuci\u00f3n/UAF en padata_reorder que se remonta a la confirmaci\u00f3n inicial. Se toma un recuento de referencias al inicio del proceso en padata_do_parallel y se libera al final en padata_serial_worker. Este recuento de referencias es (y solo es) necesario para que padata_replace funcione correctamente. Si nunca se llama a padata_replace, no hay problema. En la funci\u00f3n padata_reorder que sirve como n\u00facleo de padata, tan pronto como padata se agrega a queue->serial.list y se libera el bloqueo de giro asociado, ese padata puede procesarse y el recuento de referencias en pd desaparecer\u00eda. Arregla esto obteniendo el siguiente padata antes de que se libere el bloqueo squeue->serial. Para que esto sea posible, simplifica padata_reorder llam\u00e1ndolo solo una vez que llega el siguiente padata."}], "lastModified": "2025-08-20T14:40:17.713", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}