CVE-2025-38584: padata: Fix pd UAF once and for all
In the Linux kernel, the following vulnerability has been resolved:
padata: Fix pd UAF once and for all
There is a race condition/UAF in padata_reorder that goes back
to the initial commit. A reference count is taken at the start
of the process in padata_do_parallel, and released at the end in
padata_serial_worker.
This reference count is (and only is) required for padata_replace
to function correctly. If padata_replace is never called then
there is no issue.
In the function padata_reorder which serves as the core of padata,
as soon as padata is added to queue->serial.list, and the associated
spin lock released, that padata may be processed and the reference
count on pd would go away.
Fix this by getting the next padata before the squeue->serial lock
is released.
In order to make this possible, simplify padata_reorder by only
calling it once the next padata arrives.
Security readout for executives and security teams
Plain-English summary
CVE-2025-38584 is a Linux kernel memory-safety flaw in the padata subsystem. A race condition can lead to use-after-free behavior under specific padata processing conditions. The public record does not provide CVSS, impact detail, or confirmed exploitation, so urgency depends on kernel exposure and vendor patch availability.
Executive priority
Medium tracking priority until vendor impact and exploitability are clarified. Patch through normal kernel maintenance, accelerating for critical Linux infrastructure if the vendor marks your kernel affected or if operational risk from kernel memory corruption is unacceptable.
Technical view
The flaw is a race/UAF in padata_reorder. The CVE says a padata item can be added to queue->serial.list, the lock released, then processed so the pd reference count goes away. The fix gets the next padata before releasing the serial queue lock and simplifies reorder timing.
Likely exposure
Exposure is limited to systems running affected Linux kernel versions or vendor kernels without the referenced stable fixes. The record lists Linux as affected, including historical and multiple stable-series versions. Distribution kernels may be backported, so package advisory status matters more than upstream version alone.
Exploitation context
The source bundle does not cite active exploitation, and KEV is false. It also does not describe attacker prerequisites, reachable interfaces, or practical impact. Treat this as a kernel reliability and potential security risk requiring vendor confirmation, not as a confirmed internet-exploited issue.
Researcher notes
Important evidence gaps remain: no CVSS, CWE, attacker model, or exploitability assessment is provided. The condition appears tied to padata_replace and padata_reorder reference lifetime. Validate by source or vendor backport status rather than assuming all named upstream versions map directly to distribution exposure.
Mitigation direction
Update Linux kernels through trusted distribution or vendor channels.
Confirm the update includes the padata UAF fix or a vendor backport.
Review vendor advisories for affected package versions and reboot requirements.
Prioritize shared, multi-user, and high-availability Linux systems.
Avoid direct wrangler or unrelated operational changes; this is kernel patching work.
Validation and detection
Inventory running kernel versions across Linux assets.
Check vendor changelogs or advisories for CVE-2025-38584 coverage.
Verify the active booted kernel after patching, not only installed packages.
For custom kernels, confirm one referenced stable commit is included.
Track exceptions where vendor status is unavailable or unclear.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Potential ATT&CK relevance
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
cve · low confidence lookup
CVE-2025-38584 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
0CVSS vectors
3Timeline events
0ADP providers
9Source links
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
CVE publishedCVE Program
The CVE record was published.
Aug 19, 2025, 17:03 UTC (UTC+00:00)
CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.