CVE-2025-21786 Overview
CVE-2025-21786 is a use-after-free vulnerability [CWE-416] in the Linux kernel workqueue subsystem. The flaw was introduced by commit 68f83057b913 ("workqueue: Reap workers via kthread_stop() and remove detach_completion"), which added logic to reap normal workers but failed to handle the rescuer worker. The same commit also removed the code that waited for the rescuer in put_unbound_pool(), creating a window where the pool reference is released before the rescuer completes detachment. Cheung Wall reported the resulting use-after-free condition. A local attacker who can trigger workqueue teardown paths could exploit the flaw to corrupt kernel memory.
Critical Impact
Local exploitation can lead to kernel memory corruption, privilege escalation, or denial of service on affected Linux systems.
Affected Products
- Linux Kernel (mainline branches containing commit 68f83057b913)
- Stable kernel trees prior to the fix commits 835b69c8, e7c16028, and e7694611
- Distributions shipping affected upstream kernel versions
Discovery Timeline
- 2025-02-27 - CVE-2025-21786 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-21786
Vulnerability Analysis
The vulnerability resides in the Linux kernel workqueue subsystem, which schedules deferred work across CPU-bound worker threads. Workqueues use a rescuer thread to guarantee forward progress when the pool cannot allocate new workers under memory pressure. The refactor in commit 68f83057b913 replaced the previous detach_completion synchronization with kthread_stop()-based reaping for normal workers.
The refactor did not extend the new reaping model to the rescuer thread. It also removed the wait logic in put_unbound_pool() that previously blocked pool destruction until the rescuer detached. As a result, put_pwq() can drop the last reference to the pool_workqueue (pwq) and its backing pool while the rescuer thread still holds pointers into that pool. Any subsequent access by the rescuer during detachment operates on freed memory.
Root Cause
The root cause is a missing synchronization primitive between rescuer detachment and pool teardown. The fix reorders the destruction sequence so put_pwq() executes only after the rescuer has fully detached from the pool, ensuring the pool reference is retained for the lifetime of the detachment operation.
Attack Vector
Exploitation requires local access with the ability to trigger workqueue destruction paths that involve a rescuer thread. An attacker able to influence memory pressure or workqueue lifecycle events could race the rescuer detachment against pool teardown to trigger the use-after-free. Successful memory reuse in the freed pool structure could allow kernel heap corruption and lead to local privilege escalation.
No verified public exploit code or proof-of-concept is available for this issue. See the upstream fixes at kernel.org commit 835b69c8, kernel.org commit e7694611, and kernel.org commit e7c16028 for technical details.
Detection Methods for CVE-2025-21786
Indicators of Compromise
- Kernel oops or panic messages referencing put_pwq, put_unbound_pool, or workqueue rescuer functions in dmesg and /var/log/kern.log
- KASAN (Kernel Address Sanitizer) reports flagging use-after-free access in workqueue destruction code paths
- Unexpected kernel crashes correlated with workqueue-heavy workloads or memory pressure conditions
Detection Strategies
- Enumerate running kernel versions across the fleet and cross-reference against the fixed commit hashes 835b69c8, e7694611, and e7c16028
- Enable KASAN in non-production kernels to identify use-after-free access in the workqueue subsystem
- Monitor for anomalous kernel thread termination sequences involving rescuer workers
Monitoring Recommendations
- Forward kernel logs to a centralized logging platform and alert on panic strings referencing workqueue teardown functions
- Track privilege escalation indicators such as unexpected UID 0 process spawns following kernel warnings
- Baseline workqueue-related crash frequency and alert on statistical anomalies
How to Mitigate CVE-2025-21786
Immediate Actions Required
- Apply the upstream kernel patches referenced by commits 835b69c8, e7694611, and e7c16028 or install vendor-supplied kernel updates
- Prioritize patching multi-tenant hosts, container hosts, and systems where untrusted local users execute code
- Reboot systems after kernel installation to activate the patched image
Patch Information
The fix moves the put_pwq() call after the rescuer detaches from the pool, ensuring the pool reference is held throughout detachment. Patches are available in the mainline and stable trees. Reference the fix commits at kernel.org commit 835b69c8, kernel.org commit e7694611, and kernel.org commit e7c16028. Consult your distribution security tracker (Red Hat, SUSE, Ubuntu, Debian) for backported package versions.
Workarounds
- No configuration-level workaround exists; the flaw is in kernel code and requires a patched kernel
- Restrict local shell access and container escape surfaces to reduce the population of users able to trigger the race
- Enforce least privilege and mandatory access controls (SELinux, AppArmor) to limit post-exploitation impact
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
