CVE-2025-38031

MEDIUM EPSS 6.2%
Published Jun 18, 20251y ago · Modified Jun 17, 20261w ago
5.5 CVSS 3.1
Medium
Find Similar
Published Jun 18, 2025 1y ago
Last Modified Jun 17, 2026 1w ago

Description

In the Linux kernel, the following vulnerability has been resolved: padata: do not leak refcount in reorder_work A recent patch that addressed a UAF introduced a reference count leak: the parallel_data refcount is incremented unconditionally, regardless of the return value of queue_work(). If the work item is already queued, the incremented refcount is never decremented. Fix this by checking the return value of queue_work() and decrementing the refcount when necessary. Resolves: Unreferenced object 0xffff9d9f421e3d80 (size 192): comm "cryptomgr_probe", pid 157, jiffies 4294694003 hex dump (first 32 bytes): 80 8b cf 41 9f 9d ff ff b8 97 e0 89 ff ff ff ff ...A............ d0 97 e0 89 ff ff ff ff 19 00 00 00 1f 88 23 00 ..............#. backtrace (crc 838fb36): __kmalloc_cache_noprof+0x284/0x320 padata_alloc_pd+0x20/0x1e0 padata_alloc_shell+0x3b/0xa0 0xffffffffc040a54d cryptomgr_probe+0x43/0xc0 kthread+0xf6/0x1f0 ret_from_fork+0x2f/0x50 ret_from_fork_asm+0x1a/0x30

CVSS Details

Base Score
5.5
Exploitability
1.8
Impact
3.6
Vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack Vector Local
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality None
Integrity None
Availability High

Threat Intelligence

EPSS Exploit Probability
6.2% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Affected Products 14

VendorProductVersionRange
linuxlinux_kernel*≥5.10.235  –  <5.10.238
linuxlinux_kernel*≥5.15.179  –  <5.15.185
linuxlinux_kernel*≥6.1.129  –  <6.1.141
linuxlinux_kernel*≥6.6.76  –  <6.6.93
linuxlinux_kernel*≥6.12.13  –  <6.12.31
linuxlinux_kernel*≥6.13.2  –  <6.14.9
linuxlinux_kernel6.15any
linuxlinux_kernel6.15any
linuxlinux_kernel6.15any
linuxlinux_kernel6.15any
linuxlinux_kernel6.15any
linuxlinux_kernel6.15any
linuxlinux_kernel6.15any
debiandebian_linux11.0any

References 9

  • git.kernel.org https://git.kernel.org/stable/c/1a426abdf1c86882c9203dd8182f3b8274b89938
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/1c65ae4988714716101555fe2b9830e33136d6fb
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/5300e487487d7a2e3e1e6e9d8f03ed9452e4019e
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/584a729615fa92f4de45480efb7e569d14be1516
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/b9ad8e50e8589607e68e6c4cefa7f72bf35a2cb1
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/cceb15864e1612ebfbc10ec4e4dcd19a10c0056c
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/d6ebcde6d4ecf34f8495fb30516645db3aea8993
    Patch
  • lists.debian.org https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html
    Third Party Advisory
  • lists.debian.org https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html
    Third Party Advisory

Remediation

  • git.kernel.org https://git.kernel.org/stable/c/1a426abdf1c86882c9203dd8182f3b8274b89938
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/1c65ae4988714716101555fe2b9830e33136d6fb
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/5300e487487d7a2e3e1e6e9d8f03ed9452e4019e
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/584a729615fa92f4de45480efb7e569d14be1516
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/b9ad8e50e8589607e68e6c4cefa7f72bf35a2cb1
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/cceb15864e1612ebfbc10ec4e4dcd19a10c0056c
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/d6ebcde6d4ecf34f8495fb30516645db3aea8993
    Patch