Answer in brief
CVE-2025-38031 records a Medium severity (CVSS 5.5) vulnerability in padata: do not leak refcount in reorder_work. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 5.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Product | Affected versions | Fixed versions |
|---|---|---|
| cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:6.15:rc1:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:6.15:rc2:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:6.15:rc3:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:6.15:rc4:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:6.15:rc5:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:6.15:rc6:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:6.15:rc7:*:*:*:*:*:* | Not reported | Not reported |
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=f4f1b1169fc3694f9bc3e28c6c68dbbf4cc744c0 <b9ad8e50e8589607e68e6c4cefa7f72bf35a2cb1 || >=4c6209efea2208597dbd3e52dc87a0d1a8f2dbe1 <1a426abdf1c86882c9203dd8182f3b8274b89938 || >=7000507bb0d2ceb545c0a690e0c707c897d102c2 <cceb15864e1612ebfbc10ec4e4dcd19a10c0056c || >=6f45ef616775b0ce7889b0f6077fc8d681ab30bc <584a729615fa92f4de45480efb7e569d14be1516 || >=8ca38d0ca8c3d30dd18d311f1a7ec5cb56972cac <5300e487487d7a2e3e1e6e9d8f03ed9452e4019e || >=dd7d37ccf6b11f3d95e797ebe4e9e886d0332600 <1c65ae4988714716101555fe2b9830e33136d6fb || >=dd7d37ccf6b11f3d95e797ebe4e9e886d0332600 <d6ebcde6d4ecf34f8495fb30516645db3aea8993 || a54091c24220a4cd847d5b4f36d678edacddbaf0 || >=5.10.235 <5.10.238 || >=5.15.179 <5.15.185 || >=6.1.129 <6.1.141 || >=6.6.76 <6.6.93 || >=6.12.13 <6.12.31 || >=6.13.2 <6.14 | b9ad8e50e8589607e68e6c4cefa7f72bf35a2cb1, 1a426abdf1c86882c9203dd8182f3b8274b89938, cceb15864e1612ebfbc10ec4e4dcd19a10c0056c, 584a729615fa92f4de45480efb7e569d14be1516, 5300e487487d7a2e3e1e6e9d8f03ed9452e4019e, 1c65ae4988714716101555fe2b9830e33136d6fb, d6ebcde6d4ecf34f8495fb30516645db3aea8993, 5.10.238, 5.15.185, 6.1.141, 6.6.93, 6.12.31, 6.14 |
| Linux/Linuxgeneric | 6.14 | Not reported |
Published upstream
Jun 18, 2025
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Nov 5, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Nov 5, 2026
In the Linux kernel, the following vulnerability has been resolved: padata: do not leak refcount in reorder_work A recent patch that addressed a UAF introduced a reference count leak: the parallel_data refcount is incremented unconditionally, regardless of the return value of queue_work(). If the work item is already queued, the incremented refcount is never decremented. Fix this by checking the return value of queue_work() and decrementing the refcount when necessary. Resolves: Unreferenced object 0xffff9d9f421e3d80 (size 192): comm "cryptomgr_probe", pid 157, jiffies 4294694003 hex dump (first 32 bytes): 80 8b cf 41 9f 9d ff ff b8 97 e0 89 ff ff ff ff ...A............ d0 97 e0 89 ff ff ff ff 19 00 00 00 1f 88 23 00 ..............#. backtrace (crc 838fb36): __kmalloc_cache_noprof+0x284/0x320 padata_alloc_pd+0x20/0x1e0 padata_alloc_shell+0x3b/0xa0 0xffffffffc040a54d cryptomgr_probe+0x43/0xc0 kthread+0xf6/0x1f0 ret_from_fork+0x2f/0x50 ret_from_fork_asm+0x1a/0x30
Quoted source text, attributed separately from HOL analysis.