High 7.8Published Feb 26, 2025

CVE-2025-21726padata: avoid UAF for reorder_work

Updated under an hour ago (Oct 27, 2026, 4:50 PM ET)

Does this affect you?

It affects Linux and 2 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: padata: avoid UAF for reorder_work Although the previous patch can avoid ps and ps UAF for _do_serial, it can not avoid potential UAF issue for reorder_work. This issue can happen just as below: crypto_request crypto_request crypto_del_alg padata_do_serial ... padata_reorder // processes all remaining // requests then breaks while (1) { if (!padata) break; ... } padata_do_serial // new request added list_add // sees the new request queue_work(reorder_work) padata_reorder queue_work_on(squeue->work) ... <kworker context> padata_serial_worker // completes new request, // no more outstanding // requests crypto_del_alg // free pd <kworker context> invoke_padata_reorder // UAF of pd To avoid UAF for 'reorder_work', get 'pd' ref before put 'reorder_work' into the 'serial_wq' and put 'pd' ref until the 'serial_wq' finish.

CVSS: 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-416
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 14, 2026
First seen by InfoSec Signals: Oct 14, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from bbefa1dd6a6d53537c11624752219e39959d04fb before f4f1b1169fc3694f9bc3e28c6c68dbbf4cc744c0; from bbefa1dd6a6d53537c11624752219e39959d04fb before 4c6209efea2208597dbd3e52dc87a0d1a8f2dbe1; from bbefa1dd6a6d53537c11624752219e39959d04fb before 7000507bb0d2ceb545c0a690e0c707c897d102c2; from bbefa1dd6a6d53537c11624752219e39959d04fb before 6f45ef616775b0ce7889b0f6077fc8d681ab30bc; from bbefa1dd6a6d53537c11624752219e39959d04fb before 8ca38d0ca8c3d30dd18d311f1a7ec5cb56972cac; from bbefa1dd6a6d53537c11624752219e39959d04fb before a54091c24220a4cd847d5b4f36d678edacddbaf0; from bbefa1dd6a6d53537c11624752219e39959d04fb before dd7d37ccf6b11f3d95e797ebe4e9e886d0332600; b4c8ed0bf977760a206997b6429a7ac91978f440; and 3 more ranges	CNA record
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem siemens:simatic_s7_1500_tm_mfp_gnu_linux_subsystem (from the name)	all versions	CISA ADP
linux linux_kernel linux:linux_kernel	from 5.4.19 before 5.5; from 5.5.3 before 5.10.235; from 5.11 before 5.15.79; from 5.16 before 6.1.129; from 6.2 before 6.6.76; from 6.7 before 6.12.13; from 6.13 before 6.13.2	NVD

References

References

https://git.kernel.org/stable/c/f4f1b1169fc3694f9bc3e28c6c68dbbf4cc744c0	patch
https://git.kernel.org/stable/c/4c6209efea2208597dbd3e52dc87a0d1a8f2dbe1	patch
https://git.kernel.org/stable/c/7000507bb0d2ceb545c0a690e0c707c897d102c2	patch
https://git.kernel.org/stable/c/6f45ef616775b0ce7889b0f6077fc8d681ab30bc	patch
https://git.kernel.org/stable/c/8ca38d0ca8c3d30dd18d311f1a7ec5cb56972cac	patch
https://git.kernel.org/stable/c/a54091c24220a4cd847d5b4f36d678edacddbaf0	patch
https://git.kernel.org/stable/c/dd7d37ccf6b11f3d95e797ebe4e9e886d0332600	patch
https://lists.debian.org/debian-lts-announce/2025/03/msg00028.html
https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html
https://cert-portal.siemens.com/productcert/html/ssa-265688.html
1–10 of 11

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.