Answer in brief
CVE-2025-38584 records a High severity (CVSS 7.0) vulnerability in padata: Fix pd UAF once and for all. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic), Siemens/SIMATIC S7-1500 TM MFP - GNU/Linux subsystem (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.0. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic), Siemens/SIMATIC S7-1500 TM MFP - GNU/Linux subsystem (generic). Check affected ranges and fixed versions before updating.
| Product | Affected versions | Fixed versions |
|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | Not reported | Not reported |
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=16295bec6398a3eedc9377e1af6ff4c71b98c300 <a2048e475e22b13dc3e53d485b7e6e11464ed9a6 || >=16295bec6398a3eedc9377e1af6ff4c71b98c300 <73f132e60857038416540c3599b1de6033d7575a || >=16295bec6398a3eedc9377e1af6ff4c71b98c300 <609e59193fc6d9dd323f1c6ae1fdd721f1c79680 || >=16295bec6398a3eedc9377e1af6ff4c71b98c300 <a11a12a9880ab37342b73c93cfe1a3ada02ff0db || >=16295bec6398a3eedc9377e1af6ff4c71b98c300 <f231d5d001ec75f5886c02d496a4c79edc383d45 || >=16295bec6398a3eedc9377e1af6ff4c71b98c300 <dbe3e911a59bda6de96e7cae387ff882c2c177fa || >=16295bec6398a3eedc9377e1af6ff4c71b98c300 <cdf79bd2e1ecb3cc75631c73d8f4149be6019a52 || >=16295bec6398a3eedc9377e1af6ff4c71b98c300 <71203f68c7749609d7fc8ae6ad054bdedeb24f91 | a2048e475e22b13dc3e53d485b7e6e11464ed9a6, 73f132e60857038416540c3599b1de6033d7575a, 609e59193fc6d9dd323f1c6ae1fdd721f1c79680, a11a12a9880ab37342b73c93cfe1a3ada02ff0db, f231d5d001ec75f5886c02d496a4c79edc383d45, dbe3e911a59bda6de96e7cae387ff882c2c177fa, cdf79bd2e1ecb3cc75631c73d8f4149be6019a52, 71203f68c7749609d7fc8ae6ad054bdedeb24f91 |
| Linux/Linuxgeneric | 2.6.34 | Not reported |
| Siemens/SIMATIC S7-1500 TM MFP - GNU/Linux subsystemgeneric | >=0 <* | * |
Published upstream
Aug 19, 2025
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 5, 2026
In the Linux kernel, the following vulnerability has been resolved: padata: Fix pd UAF once and for all There is a race condition/UAF in padata_reorder that goes back to the initial commit. A reference count is taken at the start of the process in padata_do_parallel, and released at the end in padata_serial_worker. This reference count is (and only is) required for padata_replace to function correctly. If padata_replace is never called then there is no issue. In the function padata_reorder which serves as the core of padata, as soon as padata is added to queue->serial.list, and the associated spin lock released, that padata may be processed and the reference count on pd would go away. Fix this by getting the next padata before the squeue->serial lock is released. In order to make this possible, simplify padata_reorder by only calling it once the next padata arrives.
Quoted source text, attributed separately from HOL analysis.