CVE-2025-38584: Linux Kernel Use-After-Free Vulnerability

CVE-2025-38584 Overview

CVE-2025-38584 is a use-after-free (UAF) vulnerability [CWE-416] in the Linux kernel's padata parallel execution framework. The flaw resides in the padata_reorder function and has existed since the initial padata commit. A race condition allows the parallel data structure (pd) to be freed while still in use, creating a UAF condition. Local attackers with low privileges can leverage this flaw to compromise confidentiality, integrity, and availability. The Linux kernel maintainers have released fixes across multiple stable branches.

Critical Impact
A local, low-privileged attacker can trigger a use-after-free in kernel memory that may lead to privilege escalation, kernel information disclosure, or denial of service.

Affected Products

Linux Kernel (multiple stable branches prior to fix commits)
Distributions shipping vulnerable padata code (crypto workloads, pcrypt)
Systems using padata_replace for CPU mask reconfiguration

Discovery Timeline

2025-08-19 - CVE-2025-38584 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2025-38584

Vulnerability Analysis

The padata subsystem parallelizes kernel work across CPUs and is used by components such as pcrypt. Each job takes a reference count on a parallel_data (pd) structure at the start of padata_do_parallel and releases it at the end of padata_serial_worker. The reference is required to keep pd alive across calls to padata_replace, which swaps the structure when CPU masks change.

Inside padata_reorder, a padata item is added to queue->serial.list and the associated spin lock is released. Once the lock drops, another CPU can pick up the item, run the serial worker, and drop the final reference on pd. If the original padata_reorder caller then dereferences pd to fetch the next item, it operates on freed memory. The fix retrieves the next padata before releasing the squeue->serial lock and simplifies the reorder path so it only runs when the next item arrives.

Root Cause

The root cause is an ordering error in reference-count handling under concurrent execution. The producer releases the serial queue lock before finishing its use of pd, allowing a consumer running padata_serial_worker to drop the last reference and free pd before the producer completes.

Attack Vector

Exploitation requires local access and low privileges. An attacker triggers concurrent padata workloads — for example through pcrypt-backed AEAD operations — while inducing CPU hotplug or padata_replace events. Winning the race yields a UAF on kernel-managed memory, which can be shaped into privilege escalation or a kernel panic. No user interaction is needed.

No public proof-of-concept has been released. Refer to the upstream patch commits linked below for technical specifics of the race window and fix.

Detection Methods for CVE-2025-38584

Indicators of Compromise

Kernel oops, general protection fault, or BUG: KASAN: use-after-free messages referencing padata_reorder, padata_serial_worker, or padata_do_serial in dmesg.
Unexpected kernel panics on systems running heavy pcrypt or parallel crypto workloads.
Repeated CPU hotplug events correlated with crypto subsystem crashes.

Detection Strategies

Enable KASAN on test and pre-production kernels to catch UAF conditions in padata code paths.
Monitor kernel logs for stack traces originating in kernel/padata.c and forward them to a centralized logging pipeline.
Track running kernel versions against the fixed commits 71203f6, cdf79bd, and dbe3e91 from kernel.org.

Monitoring Recommendations

Alert on unscheduled reboots or kernel crashes on hosts running crypto-heavy services (IPsec, dm-crypt, TLS termination).
Baseline padata worker thread activity and flag anomalous spikes correlated with privilege changes.
Audit which workloads invoke pcrypt and prioritize patching those hosts first.

How to Mitigate CVE-2025-38584

Immediate Actions Required

Inventory Linux hosts and identify kernels that predate the fix commits.
Apply the vendor-supplied kernel update from your distribution as soon as it is available.
Prioritize multi-tenant systems and hosts allowing untrusted local users or containers.
Reboot patched systems to activate the corrected kernel image.

Patch Information

The upstream fix is available in the following stable branch commits: Kernel commit 71203f6, Kernel commit cdf79bd, and Kernel commit dbe3e91. Additional related commits are referenced at Kernel commit 609e591, Kernel commit 73f132e, and Kernel commit f231d5d. Consume these fixes through your distribution's official kernel package channels.

Workarounds

Restrict local shell access and untrusted container workloads on unpatched hosts.
Where feasible, avoid loading pcrypt and disable parallel crypto templates that exercise padata.
Minimize CPU hotplug operations on production systems until patched.

bash

# Verify running kernel version and check for pcrypt usage
uname -r
lsmod | grep -E 'pcrypt|padata'

# Prevent pcrypt from loading on unpatched hosts (workaround only)
echo 'install pcrypt /bin/true' | sudo tee /etc/modprobe.d/disable-pcrypt.conf