CVE-2025-38031: padata: do not leak refcount in reorder_work
In the Linux kernel, the following vulnerability has been resolved:
padata: do not leak refcount in reorderwork
A recent patch that addressed a UAF introduced a reference count leak: the paralleldata refcount is incremented unconditionally, regardless of the return value of queuework(). If the work item is already queued, the incremented refcount is never decremented.
Fix this by checking the return value of queuework() and decrementing the refcount when necessary.
Resolves:
Unreferenced object 0xffff9d9f421e3d80 (size 192): comm "cryptomgrprobe", pid 157, jiffies 4294694003 hex dump (first 32 bytes): 80 8b cf 41 9f 9d ff ff b8 97 e0 89 ff ff ff ff ...A............ d0 97 e0 89 ff ff ff ff 19 00 00 00 1f 88 23 00 ..............#. backtrace (crc 838fb36): kmalloccachenoprof+0x284/0x320 padataallocpd+0x20/0x1e0 padataallocshell+0x3b/0xa0 0xffffffffc040a54d cryptomgrprobe+0x43/0xc0 kthread+0xf6/0x1f0 retfromfork+0x2f/0x50 retfromforkasm+0x1a/0x30
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1 - Compensating control
In padata reorder_work, check the return value of queue_work() and decrement the incremented parallel_data reference count when the work item is already queued.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38031?
CVE-2025-38031 is classified as a medium severity vulnerability in the Linux kernel due to a reference count leak.
How do I fix CVE-2025-38031?
To fix CVE-2025-38031, update your Linux kernel to the latest patched version available for your distribution.
Which versions of the Linux kernel are affected by CVE-2025-38031?
CVE-2025-38031 affects Linux kernel versions between 5.10.235 to 5.10.238, 5.15.179 to 5.15.185, 6.1.129 to 6.1.141, 6.6.76 to 6.6.93, 6.12.13 to 6.12.31, and 6.13.2 to 6.15-rc7.
What type of vulnerability is CVE-2025-38031?
CVE-2025-38031 is a reference count leak vulnerability that occurs in the padata subsystem of the Linux kernel.
What are the potential impacts of CVE-2025-38031?
The potential impacts of CVE-2025-38031 include denial of service or unexpected behavior in the system due to memory management issues.