CVE-2025-38031
padata: do not leak refcount in reorder_work
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
padata: do not leak refcount in reorder_work
In the Linux kernel, the following vulnerability has been resolved: padata: do not leak refcount in reorder_work A recent patch that addressed a UAF introduced a reference count leak: the parallel_data refcount is incremented unconditionally, regardless of the return value of queue_work(). If the work item is already queued, the incremented refcount is never decremented. Fix this by checking the return value of queue_work() and decrementing the refcount when necessary. Resolves: Unreferenced object 0xffff9d9f421e3d80 (size 192): comm "cryptomgr_probe", pid 157, jiffies 4294694003 hex dump (first 32 bytes): 80 8b cf 41 9f 9d ff ff b8 97 e0 89 ff ff ff ff ...A............ d0 97 e0 89 ff ff ff ff 19 00 00 00 1f 88 23 00 ..............#. backtrace (crc 838fb36): __kmalloc_cache_noprof+0x284/0x320 padata_alloc_pd+0x20/0x1e0 padata_alloc_shell+0x3b/0xa0 0xffffffffc040a54d cryptomgr_probe+0x43/0xc0 kthread+0xf6/0x1f0 ret_from_fork+0x2f/0x50 ret_from_fork_asm+0x1a/0x30
Reserved 2025-04-16 | Published 2025-06-18 | Updated 2025-06-18 | Assigner Linuxgit.kernel.org/...c/b9ad8e50e8589607e68e6c4cefa7f72bf35a2cb1
git.kernel.org/...c/1a426abdf1c86882c9203dd8182f3b8274b89938
git.kernel.org/...c/cceb15864e1612ebfbc10ec4e4dcd19a10c0056c
git.kernel.org/...c/584a729615fa92f4de45480efb7e569d14be1516
git.kernel.org/...c/5300e487487d7a2e3e1e6e9d8f03ed9452e4019e
git.kernel.org/...c/1c65ae4988714716101555fe2b9830e33136d6fb
git.kernel.org/...c/d6ebcde6d4ecf34f8495fb30516645db3aea8993
Support options
