Answer in brief
CVE-2025-38584 records a Unknown severity vulnerability in padata: Fix pd UAF once and for all. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
Answer in brief
CVE-2025-38584 records a Unknown severity vulnerability in padata: Fix pd UAF once and for all. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=16295bec6398a3eedc9377e1af6ff4c71b98c300 <a2048e475e22b13dc3e53d485b7e6e11464ed9a6 || >=16295bec6398a3eedc9377e1af6ff4c71b98c300 <73f132e60857038416540c3599b1de6033d7575a || >=16295bec6398a3eedc9377e1af6ff4c71b98c300 <609e59193fc6d9dd323f1c6ae1fdd721f1c79680 || >=16295bec6398a3eedc9377e1af6ff4c71b98c300 <a11a12a9880ab37342b73c93cfe1a3ada02ff0db || >=16295bec6398a3eedc9377e1af6ff4c71b98c300 <f231d5d001ec75f5886c02d496a4c79edc383d45 || >=16295bec6398a3eedc9377e1af6ff4c71b98c300 <dbe3e911a59bda6de96e7cae387ff882c2c177fa || >=16295bec6398a3eedc9377e1af6ff4c71b98c300 <cdf79bd2e1ecb3cc75631c73d8f4149be6019a52 || >=16295bec6398a3eedc9377e1af6ff4c71b98c300 <71203f68c7749609d7fc8ae6ad054bdedeb24f91 | a2048e475e22b13dc3e53d485b7e6e11464ed9a6, 73f132e60857038416540c3599b1de6033d7575a, 609e59193fc6d9dd323f1c6ae1fdd721f1c79680, a11a12a9880ab37342b73c93cfe1a3ada02ff0db, f231d5d001ec75f5886c02d496a4c79edc383d45, dbe3e911a59bda6de96e7cae387ff882c2c177fa, cdf79bd2e1ecb3cc75631c73d8f4149be6019a52, 71203f68c7749609d7fc8ae6ad054bdedeb24f91 |
| Linux/Linuxgeneric | 2.6.34 | Not reported |
Published upstream
Aug 19, 2025
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 5, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 5, 2026
In the Linux kernel, the following vulnerability has been resolved: padata: Fix pd UAF once and for all There is a race condition/UAF in padata_reorder that goes back to the initial commit. A reference count is taken at the start of the process in padata_do_parallel, and released at the end in padata_serial_worker. This reference count is (and only is) required for padata_replace to function correctly. If padata_replace is never called then there is no issue. In the function padata_reorder which serves as the core of padata, as soon as padata is added to queue->serial.list, and the associated spin lock released, that padata may be processed and the reference count on pd would go away. Fix this by getting the next padata before the squeue->serial lock is released. In order to make this possible, simplify padata_reorder by only calling it once the next padata arrives.
Quoted source text, attributed separately from HOL analysis.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=16295bec6398a3eedc9377e1af6ff4c71b98c300 <a2048e475e22b13dc3e53d485b7e6e11464ed9a6 || >=16295bec6398a3eedc9377e1af6ff4c71b98c300 <73f132e60857038416540c3599b1de6033d7575a || >=16295bec6398a3eedc9377e1af6ff4c71b98c300 <609e59193fc6d9dd323f1c6ae1fdd721f1c79680 || >=16295bec6398a3eedc9377e1af6ff4c71b98c300 <a11a12a9880ab37342b73c93cfe1a3ada02ff0db || >=16295bec6398a3eedc9377e1af6ff4c71b98c300 <f231d5d001ec75f5886c02d496a4c79edc383d45 || >=16295bec6398a3eedc9377e1af6ff4c71b98c300 <dbe3e911a59bda6de96e7cae387ff882c2c177fa || >=16295bec6398a3eedc9377e1af6ff4c71b98c300 <cdf79bd2e1ecb3cc75631c73d8f4149be6019a52 || >=16295bec6398a3eedc9377e1af6ff4c71b98c300 <71203f68c7749609d7fc8ae6ad054bdedeb24f91 | a2048e475e22b13dc3e53d485b7e6e11464ed9a6, 73f132e60857038416540c3599b1de6033d7575a, 609e59193fc6d9dd323f1c6ae1fdd721f1c79680, a11a12a9880ab37342b73c93cfe1a3ada02ff0db, f231d5d001ec75f5886c02d496a4c79edc383d45, dbe3e911a59bda6de96e7cae387ff882c2c177fa, cdf79bd2e1ecb3cc75631c73d8f4149be6019a52, 71203f68c7749609d7fc8ae6ad054bdedeb24f91 |
| Linux/Linuxgeneric | 2.6.34 | Not reported |
Published upstream
Aug 19, 2025
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 5, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 5, 2026
In the Linux kernel, the following vulnerability has been resolved: padata: Fix pd UAF once and for all There is a race condition/UAF in padata_reorder that goes back to the initial commit. A reference count is taken at the start of the process in padata_do_parallel, and released at the end in padata_serial_worker. This reference count is (and only is) required for padata_replace to function correctly. If padata_replace is never called then there is no issue. In the function padata_reorder which serves as the core of padata, as soon as padata is added to queue->serial.list, and the associated spin lock released, that padata may be processed and the reference count on pd would go away. Fix this by getting the next padata before the squeue->serial lock is released. In order to make this possible, simplify padata_reorder by only calling it once the next padata arrives.
Quoted source text, attributed separately from HOL analysis.