CVE-2025-21726 Overview
CVE-2025-21726 is a use-after-free (UAF) vulnerability in the Linux kernel's padata parallel execution subsystem. The flaw resides in the reorder_work handling path within padata_do_serial() and padata_reorder(). A race condition between concurrent crypto request submissions and crypto_del_alg can free the padata structure (pd) before the reorder worker dereferences it. The issue is tracked under CWE-416: Use After Free and affects multiple stable Linux kernel branches.
Critical Impact
Local attackers with low privileges can trigger memory corruption in the kernel's padata subsystem, leading to potential privilege escalation or denial of service.
Affected Products
- Linux Kernel (multiple stable branches prior to fixes referenced in upstream commits)
- Debian LTS distributions (per Debian LTS announcements March and May 2025)
- Siemens products referenced in Siemens Security Advisory SSA-265688
Discovery Timeline
- 2025-02-27 - CVE-2025-21726 published to NVD
- 2026-05-12 - Last updated in NVD database
Technical Details for CVE-2025-21726
Vulnerability Analysis
The padata subsystem dispatches parallel work to multiple CPUs and reorders results to preserve serial output ordering. The vulnerability stems from a race window between padata_do_serial(), the padata_reorder() loop, and crypto_del_alg().
When padata_reorder() completes the request loop and breaks out, another CPU can concurrently call padata_do_serial() to append a new request and queue reorder_work. The serial worker may then complete the new request, leaving no outstanding work. At that point, crypto_del_alg() can free the parallel data structure pd. The originally queued invoke_padata_reorder worker then dereferences the freed pd, producing a use-after-free condition.
Root Cause
The padata parallel data structure (pd) lacks a reference held by the queued reorder_work item. Existing patches addressed a similar UAF for the ps and _do_serial paths but did not extend reference counting to reorder_work. The upstream fix obtains a pd reference before placing reorder_work onto serial_wq and releases it only after the workqueue finishes processing.
Attack Vector
Exploitation requires local access and the ability to drive concurrent crypto operations while triggering crypto_del_alg. An attacker who can submit crypto requests through user-space interfaces such as AF_ALG, or otherwise schedule padata work, can race the teardown of a crypto algorithm to free pd while reorder_work remains queued. Successful exploitation yields kernel memory corruption, which can be leveraged for local privilege escalation or system instability.
No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Detection Methods for CVE-2025-21726
Indicators of Compromise
- Kernel oops or panic messages referencing padata_reorder, invoke_padata_reorder, or padata_serial_worker in dmesg and /var/log/kern.log
- KASAN reports flagging use-after-free in the padata subsystem when KASAN is enabled
- Unexpected crashes correlated with crypto algorithm registration or removal events
Detection Strategies
- Audit installed kernel versions against the fixed commits referenced by Kernel Git Commit 4c6209ef and related stable backports
- Monitor for processes invoking AF_ALG sockets or otherwise driving heavy parallel crypto workloads alongside module load/unload activity
- Correlate kernel crash telemetry with workloads that frequently add and remove crypto algorithms
Monitoring Recommendations
- Centralize kernel logs and alert on stack traces containing padata_reorder or crypto_del_alg
- Track package inventory to confirm Linux kernel patch levels match vendor advisories from Debian LTS and Siemens
- Enable kernel lockdown and reduce unprivileged access to crypto user APIs where feasible
How to Mitigate CVE-2025-21726
Immediate Actions Required
- Apply the latest kernel updates from your distribution that incorporate the upstream padata reference-counting fix
- Prioritize patching multi-tenant systems and hosts where untrusted users have local shell access
- Reboot systems after kernel package installation to ensure the patched kernel is active
Patch Information
Upstream fixes are available across stable branches. Reference the commit set on kernel.org: 4c6209ef, 6f45ef61, 7000507b, 8ca38d0c, a54091c2, dd7d37cc, and f4f1b116. Distribution-specific patches are documented in Debian LTS Announcement March 2025, Debian LTS Announcement May 2025, and Siemens Security Advisory SSA-265688.
Workarounds
- Restrict local user access to systems running unpatched kernels until updates can be applied
- Disable the AF_ALG user-space crypto interface if not required by workloads, reducing the avenues for triggering padata races
- Avoid runtime addition and removal of crypto algorithm modules on production systems where local untrusted code may run
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
