GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2025-21726 (GCVE-0-2025-21726)

Vulnerability from cvelistv5 – Published: 2025-02-27 02:07 – Updated: 2026-08-05 11:53
VLAI
Title
padata: avoid UAF for reorder_work
Summary
In the Linux kernel, the following vulnerability has been resolved: padata: avoid UAF for reorder_work Although the previous patch can avoid ps and ps UAF for _do_serial, it can not avoid potential UAF issue for reorder_work. This issue can happen just as below: crypto_request crypto_request crypto_del_alg padata_do_serial ... padata_reorder // processes all remaining // requests then breaks while (1) { if (!padata) break; ... } padata_do_serial // new request added list_add // sees the new request queue_work(reorder_work) padata_reorder queue_work_on(squeue->work) ... <kworker context> padata_serial_worker // completes new request, // no more outstanding // requests crypto_del_alg // free pd <kworker context> invoke_padata_reorder // UAF of pd To avoid UAF for 'reorder_work', get 'pd' ref before put 'reorder_work' into the 'serial_wq' and put 'pd' ref until the 'serial_wq' finish.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-02-27 17:58 UTC
CWE
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: bbefa1dd6a6d53537c11624752219e39959d04fb , < f4f1b1169fc3694f9bc3e28c6c68dbbf4cc744c0 (git)
Affected: bbefa1dd6a6d53537c11624752219e39959d04fb , < 4c6209efea2208597dbd3e52dc87a0d1a8f2dbe1 (git)
Affected: bbefa1dd6a6d53537c11624752219e39959d04fb , < 7000507bb0d2ceb545c0a690e0c707c897d102c2 (git)
Affected: bbefa1dd6a6d53537c11624752219e39959d04fb , < 6f45ef616775b0ce7889b0f6077fc8d681ab30bc (git)
Affected: bbefa1dd6a6d53537c11624752219e39959d04fb , < 8ca38d0ca8c3d30dd18d311f1a7ec5cb56972cac (git)
Affected: bbefa1dd6a6d53537c11624752219e39959d04fb , < a54091c24220a4cd847d5b4f36d678edacddbaf0 (git)
Affected: bbefa1dd6a6d53537c11624752219e39959d04fb , < dd7d37ccf6b11f3d95e797ebe4e9e886d0332600 (git)
Affected: b4c8ed0bf977760a206997b6429a7ac91978f440 (git)
Affected: e43d65719527043f1ef79ecba9d4ede58cbc7ffe (git)
Affected: 5.4.19 , < 5.5 (semver)
Affected: 5.5.3 , < 5.6 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 5.6
Unaffected: 0 , < 5.6 (semver)
Unaffected: 5.10.235 , ≤ 5.10.* (semver)
Unaffected: 5.15.179 , ≤ 5.15.* (semver)
Unaffected: 6.1.129 , ≤ 6.1.* (semver)
Unaffected: 6.6.76 , ≤ 6.6.* (semver)
Unaffected: 6.12.13 , ≤ 6.12.* (semver)
Unaffected: 6.13.2 , ≤ 6.13.* (semver)
Unaffected: 6.14 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem Affected: 0 , < * (custom)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-21726",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-27T17:58:10.478288Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-27T18:02:28.114Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T19:36:27.811Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00028.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-12T12:03:29.655Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/padata.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f4f1b1169fc3694f9bc3e28c6c68dbbf4cc744c0",
              "status": "affected",
              "version": "bbefa1dd6a6d53537c11624752219e39959d04fb",
              "versionType": "git"
            },
            {
              "lessThan": "4c6209efea2208597dbd3e52dc87a0d1a8f2dbe1",
              "status": "affected",
              "version": "bbefa1dd6a6d53537c11624752219e39959d04fb",
              "versionType": "git"
            },
            {
              "lessThan": "7000507bb0d2ceb545c0a690e0c707c897d102c2",
              "status": "affected",
              "version": "bbefa1dd6a6d53537c11624752219e39959d04fb",
              "versionType": "git"
            },
            {
              "lessThan": "6f45ef616775b0ce7889b0f6077fc8d681ab30bc",
              "status": "affected",
              "version": "bbefa1dd6a6d53537c11624752219e39959d04fb",
              "versionType": "git"
            },
            {
              "lessThan": "8ca38d0ca8c3d30dd18d311f1a7ec5cb56972cac",
              "status": "affected",
              "version": "bbefa1dd6a6d53537c11624752219e39959d04fb",
              "versionType": "git"
            },
            {
              "lessThan": "a54091c24220a4cd847d5b4f36d678edacddbaf0",
              "status": "affected",
              "version": "bbefa1dd6a6d53537c11624752219e39959d04fb",
              "versionType": "git"
            },
            {
              "lessThan": "dd7d37ccf6b11f3d95e797ebe4e9e886d0332600",
              "status": "affected",
              "version": "bbefa1dd6a6d53537c11624752219e39959d04fb",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "b4c8ed0bf977760a206997b6429a7ac91978f440",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e43d65719527043f1ef79ecba9d4ede58cbc7ffe",
              "versionType": "git"
            },
            {
              "lessThan": "5.5",
              "status": "affected",
              "version": "5.4.19",
              "versionType": "semver"
            },
            {
              "lessThan": "5.6",
              "status": "affected",
              "version": "5.5.3",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/padata.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.6"
            },
            {
              "lessThan": "5.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.235",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.179",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.129",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.76",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.14",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.235",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.179",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.129",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.76",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.13",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.2",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.5.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\npadata: avoid UAF for reorder_work\n\nAlthough the previous patch can avoid ps and ps UAF for _do_serial, it\ncan not avoid potential UAF issue for reorder_work. This issue can\nhappen just as below:\n\ncrypto_request\t\t\tcrypto_request\t\tcrypto_del_alg\npadata_do_serial\n  ...\n  padata_reorder\n    // processes all remaining\n    // requests then breaks\n    while (1) {\n      if (!padata)\n        break;\n      ...\n    }\n\n\t\t\t\tpadata_do_serial\n\t\t\t\t  // new request added\n\t\t\t\t  list_add\n    // sees the new request\n    queue_work(reorder_work)\n\t\t\t\t  padata_reorder\n\t\t\t\t    queue_work_on(squeue-\u003ework)\n...\n\n\t\t\t\t\u003ckworker context\u003e\n\t\t\t\tpadata_serial_worker\n\t\t\t\t// completes new request,\n\t\t\t\t// no more outstanding\n\t\t\t\t// requests\n\n\t\t\t\t\t\t\tcrypto_del_alg\n\t\t\t\t\t\t\t  // free pd\n\n\u003ckworker context\u003e\ninvoke_padata_reorder\n  // UAF of pd\n\nTo avoid UAF for \u0027reorder_work\u0027, get \u0027pd\u0027 ref before put \u0027reorder_work\u0027\ninto the \u0027serial_wq\u0027 and put \u0027pd\u0027 ref until the \u0027serial_wq\u0027 finish."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable padata reorder machinery is driven through pcrypt, reached locally via AF_ALG (`algif_aead`) socket operations or local xfrm/IPsec setup, and the `pd` free is triggered by local crypto-netlink/CPU-hotplug activity. No remote peer can reach or free the `parallel_data` object, so the attack requires local system access.\nAC:L - The attacker controls both sides of the race \u2014 they submit an unbounded stream of concurrent pcrypt AEAD requests to keep `reorder_work` queued while simultaneously driving the shell/pd teardown, and `serial_wq` is allocated with `max_active=1`, so `reorder_work` is routinely stalled behind serial workers, widening the window. Repeated attempts in a tight loop make the race reliably winnable, as the LTP `pcrypt_aead01` reproducer for the sibling bug demonstrates.\nPR:L - An unprivileged local user can fully drive the parallel/serial request side with no capability check at all via `AF_ALG` `algif_aead` binding `pcrypt(rfc4106(gcm(aes)))`, and the pd-release side is reachable through `padata_replace()` on CPU hotplug (suspend/resume, which logind grants to active unprivileged sessions) as well as through crypto netlink. No root-only gate is required on the path that actually corrupts memory.\nUI:N - The attacker issues both the crypto requests and the teardown that frees `parallel_data` themselves; no victim must mount a filesystem, open a file, or take any other action.\nS:U - The use-after-free corrupts kernel heap memory and is exploited within the same kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - After `pd` is freed and reclaimed by sprayed attacker data, `padata_reorder()` follows `pd-\u003eps-\u003epinst`, `pd-\u003ereorder_list`, `pd-\u003esqueue` and `pd-\u003ecpumask.pcpu` out of the freed object, giving an attacker-directed read primitive over arbitrary kernel memory and disclosure of kernel state.\nI:H - The same freed object yields write primitives \u2014 `spin_trylock_bh(\u0026pd-\u003elock)`, `refcount_inc(\u0026pd-\u003erefcnt)`, `++pd-\u003eprocessed`, and especially `list_del_init()`/`list_add_tail()` through attacker-controlled `reorder_list`/`squeue` pointers, plus a controlled `workqueue_struct *` fed to `queue_work_on()` \u2014 which is exploitable for arbitrary write and control-flow hijack leading to privilege escalation.\nA:H - Even without successful heap grooming, dereferencing the freed `parallel_data` reliably produces a KASAN slab-use-after-free splat, spinlock corruption, and kernel oops/panic, taking the whole system down; the crash can be reproduced repeatedly."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:53:59.161Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f4f1b1169fc3694f9bc3e28c6c68dbbf4cc744c0"
        },
        {
          "url": "https://git.kernel.org/stable/c/4c6209efea2208597dbd3e52dc87a0d1a8f2dbe1"
        },
        {
          "url": "https://git.kernel.org/stable/c/7000507bb0d2ceb545c0a690e0c707c897d102c2"
        },
        {
          "url": "https://git.kernel.org/stable/c/6f45ef616775b0ce7889b0f6077fc8d681ab30bc"
        },
        {
          "url": "https://git.kernel.org/stable/c/8ca38d0ca8c3d30dd18d311f1a7ec5cb56972cac"
        },
        {
          "url": "https://git.kernel.org/stable/c/a54091c24220a4cd847d5b4f36d678edacddbaf0"
        },
        {
          "url": "https://git.kernel.org/stable/c/dd7d37ccf6b11f3d95e797ebe4e9e886d0332600"
        }
      ],
      "title": "padata: avoid UAF for reorder_work",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-21726",
    "datePublished": "2025-02-27T02:07:32.861Z",
    "dateReserved": "2024-12-29T08:45:45.754Z",
    "dateUpdated": "2026-08-05T11:53:59.161Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-21726",
      "date": "2026-09-16",
      "epss": "0.00231",
      "percentile": "0.14097"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-21726\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-02-27T02:15:16.323\",\"lastModified\":\"2026-06-17T08:44:07.860\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\npadata: avoid UAF for reorder_work\\n\\nAlthough the previous patch can avoid ps and ps UAF for _do_serial, it\\ncan not avoid potential UAF issue for reorder_work. This issue can\\nhappen just as below:\\n\\ncrypto_request\\t\\t\\tcrypto_request\\t\\tcrypto_del_alg\\npadata_do_serial\\n  ...\\n  padata_reorder\\n    // processes all remaining\\n    // requests then breaks\\n    while (1) {\\n      if (!padata)\\n        break;\\n      ...\\n    }\\n\\n\\t\\t\\t\\tpadata_do_serial\\n\\t\\t\\t\\t  // new request added\\n\\t\\t\\t\\t  list_add\\n    // sees the new request\\n    queue_work(reorder_work)\\n\\t\\t\\t\\t  padata_reorder\\n\\t\\t\\t\\t    queue_work_on(squeue-\u003ework)\\n...\\n\\n\\t\\t\\t\\t\u003ckworker context\u003e\\n\\t\\t\\t\\tpadata_serial_worker\\n\\t\\t\\t\\t// completes new request,\\n\\t\\t\\t\\t// no more outstanding\\n\\t\\t\\t\\t// requests\\n\\n\\t\\t\\t\\t\\t\\t\\tcrypto_del_alg\\n\\t\\t\\t\\t\\t\\t\\t  // free pd\\n\\n\u003ckworker context\u003e\\ninvoke_padata_reorder\\n  // UAF of pd\\n\\nTo avoid UAF for \u0027reorder_work\u0027, get \u0027pd\u0027 ref before put \u0027reorder_work\u0027\\ninto the \u0027serial_wq\u0027 and put \u0027pd\u0027 ref until the \u0027serial_wq\u0027 finish.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: padata: avoid UAF for reorder_work Although the previous patch can avoid ps and ps UAF for _do_serial, it can not avoid potential UAF issue for reorder_work. This issue can happen just as below: crypto_request crypto_request crypto_del_alg padata_do_serial ... padata_reorder // processes all remaining // requests then breaks while (1) { if (!padata) break; ... } padata_do_serial // new request added list_add // sees the new request queue_work(reorder_work) padata_reorder queue_work_on(squeue-\u0026gt;work) ...  padata_serial_worker // completes new request, // no more outstanding // requests crypto_del_alg // free pd  invoke_padata_reorder // UAF of pd To avoid UAF for \u0027reorder_work\u0027, get \u0027pd\u0027 ref before put \u0027reorder_work\u0027 into the \u0027serial_wq\u0027 and put \u0027pd\u0027 ref until the \u0027serial_wq\u0027 finish. \"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"kernel/padata.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"bbefa1dd6a6d53537c11624752219e39959d04fb\",\"lessThan\":\"f4f1b1169fc3694f9bc3e28c6c68dbbf4cc744c0\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"bbefa1dd6a6d53537c11624752219e39959d04fb\",\"lessThan\":\"4c6209efea2208597dbd3e52dc87a0d1a8f2dbe1\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"bbefa1dd6a6d53537c11624752219e39959d04fb\",\"lessThan\":\"7000507bb0d2ceb545c0a690e0c707c897d102c2\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"bbefa1dd6a6d53537c11624752219e39959d04fb\",\"lessThan\":\"6f45ef616775b0ce7889b0f6077fc8d681ab30bc\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"bbefa1dd6a6d53537c11624752219e39959d04fb\",\"lessThan\":\"8ca38d0ca8c3d30dd18d311f1a7ec5cb56972cac\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"bbefa1dd6a6d53537c11624752219e39959d04fb\",\"lessThan\":\"a54091c24220a4cd847d5b4f36d678edacddbaf0\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"bbefa1dd6a6d53537c11624752219e39959d04fb\",\"lessThan\":\"dd7d37ccf6b11f3d95e797ebe4e9e886d0332600\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b4c8ed0bf977760a206997b6429a7ac91978f440\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e43d65719527043f1ef79ecba9d4ede58cbc7ffe\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5.4.19\",\"lessThan\":\"5.5\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.5.3\",\"lessThan\":\"5.6\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"kernel/padata.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.6\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.6\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.235\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.179\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.129\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.76\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.13\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.13.2\",\"lessThanOrEqual\":\"6.13.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.14\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]},{\"source\":\"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\",\"affectedData\":[{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2025-02-27T17:58:10.478288Z\",\"id\":\"CVE-2025-21726\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.4.19\",\"versionEndExcluding\":\"5.5\",\"matchCriteriaId\":\"F8D27E1D-B88C-4DA9-AA0B-5EE142C053FB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5.3\",\"versionEndExcluding\":\"5.10.235\",\"matchCriteriaId\":\"788E7D29-360A-41BA-8805-31648EE009B3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.79\",\"matchCriteriaId\":\"39DC45D8-E30E-4F4A-9332-393B7BCF6900\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.129\",\"matchCriteriaId\":\"2DA5009C-C9B9-4A1D-9B96-78427E8F232C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.76\",\"matchCriteriaId\":\"A6D70701-9CB6-4222-A957-00A419878993\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.13\",\"matchCriteriaId\":\"2897389C-A8C3-4D69-90F2-E701B3D66373\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.13.2\",\"matchCriteriaId\":\"6D4116B1-1BFD-4F23-BA84-169CC05FC5A3\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/4c6209efea2208597dbd3e52dc87a0d1a8f2dbe1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/6f45ef616775b0ce7889b0f6077fc8d681ab30bc\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7000507bb0d2ceb545c0a690e0c707c897d102c2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8ca38d0ca8c3d30dd18d311f1a7ec5cb56972cac\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a54091c24220a4cd847d5b4f36d678edacddbaf0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/dd7d37ccf6b11f3d95e797ebe4e9e886d0332600\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f4f1b1169fc3694f9bc3e28c6c68dbbf4cc744c0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/03/msg00028.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://cert-portal.siemens.com/productcert/html/ssa-265688.html\",\"source\":\"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-06-29T23:58:17+00:00",
      "cve": "CVE-2025-21726",
      "id": "CVE-2025-21726",
      "initial_release_date": "2025-02-27T00:00:00+00:00",
      "product_status:fixed": "917",
      "product_status:known_affected": "98",
      "product_status:known_not_affected": "14",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: padata: avoid UAF for reorder_work",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-21726.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-08-29T01:28:24Z",
      "cve": "CVE-2025-21726",
      "id": "CVE-2025-21726",
      "initial_release_date": "2025-02-28T02:21:51Z",
      "product_status:known_affected": "380",
      "product_status:known_not_affected": "252",
      "product_status:recommended": "741",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-21726",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-21726.json",
      "version": "57"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html\"}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2025/03/msg00028.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T19:36:27.811Z\"}}, {\"affected\": [{\"vendor\": \"Siemens\", \"product\": \"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}], \"x_adpType\": \"supplier\", \"references\": [{\"url\": \"https://cert-portal.siemens.com/productcert/html/ssa-265688.html\"}], \"providerMetadata\": {\"orgId\": \"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\", \"shortName\": \"siemens-SADP\", \"dateUpdated\": \"2026-05-12T12:03:29.655Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.8, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-21726\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-02-27T17:58:10.478288Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-416\", \"description\": \"CWE-416 Use After Free\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-02-27T17:58:11.777Z\"}}], \"cna\": {\"title\": \"padata: avoid UAF for reorder_work\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The vulnerable padata reorder machinery is driven through pcrypt, reached locally via AF_ALG (`algif_aead`) socket operations or local xfrm/IPsec setup, and the `pd` free is triggered by local crypto-netlink/CPU-hotplug activity. No remote peer can reach or free the `parallel_data` object, so the attack requires local system access.\\nAC:L - The attacker controls both sides of the race \\u2014 they submit an unbounded stream of concurrent pcrypt AEAD requests to keep `reorder_work` queued while simultaneously driving the shell/pd teardown, and `serial_wq` is allocated with `max_active=1`, so `reorder_work` is routinely stalled behind serial workers, widening the window. Repeated attempts in a tight loop make the race reliably winnable, as the LTP `pcrypt_aead01` reproducer for the sibling bug demonstrates.\\nPR:L - An unprivileged local user can fully drive the parallel/serial request side with no capability check at all via `AF_ALG` `algif_aead` binding `pcrypt(rfc4106(gcm(aes)))`, and the pd-release side is reachable through `padata_replace()` on CPU hotplug (suspend/resume, which logind grants to active unprivileged sessions) as well as through crypto netlink. No root-only gate is required on the path that actually corrupts memory.\\nUI:N - The attacker issues both the crypto requests and the teardown that frees `parallel_data` themselves; no victim must mount a filesystem, open a file, or take any other action.\\nS:U - The use-after-free corrupts kernel heap memory and is exploited within the same kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\\nC:H - After `pd` is freed and reclaimed by sprayed attacker data, `padata_reorder()` follows `pd-\u003eps-\u003epinst`, `pd-\u003ereorder_list`, `pd-\u003esqueue` and `pd-\u003ecpumask.pcpu` out of the freed object, giving an attacker-directed read primitive over arbitrary kernel memory and disclosure of kernel state.\\nI:H - The same freed object yields write primitives \\u2014 `spin_trylock_bh(\u0026pd-\u003elock)`, `refcount_inc(\u0026pd-\u003erefcnt)`, `++pd-\u003eprocessed`, and especially `list_del_init()`/`list_add_tail()` through attacker-controlled `reorder_list`/`squeue` pointers, plus a controlled `workqueue_struct *` fed to `queue_work_on()` \\u2014 which is exploitable for arbitrary write and control-flow hijack leading to privilege escalation.\\nA:H - Even without successful heap grooming, dereferencing the freed `parallel_data` reliably produces a KASAN slab-use-after-free splat, spinlock corruption, and kernel oops/panic, taking the whole system down; the crash can be reproduced repeatedly.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"bbefa1dd6a6d53537c11624752219e39959d04fb\", \"lessThan\": \"f4f1b1169fc3694f9bc3e28c6c68dbbf4cc744c0\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"bbefa1dd6a6d53537c11624752219e39959d04fb\", \"lessThan\": \"4c6209efea2208597dbd3e52dc87a0d1a8f2dbe1\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"bbefa1dd6a6d53537c11624752219e39959d04fb\", \"lessThan\": \"7000507bb0d2ceb545c0a690e0c707c897d102c2\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"bbefa1dd6a6d53537c11624752219e39959d04fb\", \"lessThan\": \"6f45ef616775b0ce7889b0f6077fc8d681ab30bc\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"bbefa1dd6a6d53537c11624752219e39959d04fb\", \"lessThan\": \"8ca38d0ca8c3d30dd18d311f1a7ec5cb56972cac\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"bbefa1dd6a6d53537c11624752219e39959d04fb\", \"lessThan\": \"a54091c24220a4cd847d5b4f36d678edacddbaf0\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"bbefa1dd6a6d53537c11624752219e39959d04fb\", \"lessThan\": \"dd7d37ccf6b11f3d95e797ebe4e9e886d0332600\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"b4c8ed0bf977760a206997b6429a7ac91978f440\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"e43d65719527043f1ef79ecba9d4ede58cbc7ffe\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"5.4.19\", \"lessThan\": \"5.5\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"5.5.3\", \"lessThan\": \"5.6\", \"versionType\": \"semver\"}], \"programFiles\": [\"kernel/padata.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.6\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.6\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.10.235\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.179\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.129\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.76\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12.13\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.12.*\"}, {\"status\": \"unaffected\", \"version\": \"6.13.2\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.13.*\"}, {\"status\": \"unaffected\", \"version\": \"6.14\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"kernel/padata.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/f4f1b1169fc3694f9bc3e28c6c68dbbf4cc744c0\"}, {\"url\": \"https://git.kernel.org/stable/c/4c6209efea2208597dbd3e52dc87a0d1a8f2dbe1\"}, {\"url\": \"https://git.kernel.org/stable/c/7000507bb0d2ceb545c0a690e0c707c897d102c2\"}, {\"url\": \"https://git.kernel.org/stable/c/6f45ef616775b0ce7889b0f6077fc8d681ab30bc\"}, {\"url\": \"https://git.kernel.org/stable/c/8ca38d0ca8c3d30dd18d311f1a7ec5cb56972cac\"}, {\"url\": \"https://git.kernel.org/stable/c/a54091c24220a4cd847d5b4f36d678edacddbaf0\"}, {\"url\": \"https://git.kernel.org/stable/c/dd7d37ccf6b11f3d95e797ebe4e9e886d0332600\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\npadata: avoid UAF for reorder_work\\n\\nAlthough the previous patch can avoid ps and ps UAF for _do_serial, it\\ncan not avoid potential UAF issue for reorder_work. This issue can\\nhappen just as below:\\n\\ncrypto_request\\t\\t\\tcrypto_request\\t\\tcrypto_del_alg\\npadata_do_serial\\n  ...\\n  padata_reorder\\n    // processes all remaining\\n    // requests then breaks\\n    while (1) {\\n      if (!padata)\\n        break;\\n      ...\\n    }\\n\\n\\t\\t\\t\\tpadata_do_serial\\n\\t\\t\\t\\t  // new request added\\n\\t\\t\\t\\t  list_add\\n    // sees the new request\\n    queue_work(reorder_work)\\n\\t\\t\\t\\t  padata_reorder\\n\\t\\t\\t\\t    queue_work_on(squeue-\u003ework)\\n...\\n\\n\\t\\t\\t\\t\u003ckworker context\u003e\\n\\t\\t\\t\\tpadata_serial_worker\\n\\t\\t\\t\\t// completes new request,\\n\\t\\t\\t\\t// no more outstanding\\n\\t\\t\\t\\t// requests\\n\\n\\t\\t\\t\\t\\t\\t\\tcrypto_del_alg\\n\\t\\t\\t\\t\\t\\t\\t  // free pd\\n\\n\u003ckworker context\u003e\\ninvoke_padata_reorder\\n  // UAF of pd\\n\\nTo avoid UAF for \u0027reorder_work\u0027, get \u0027pd\u0027 ref before put \u0027reorder_work\u0027\\ninto the \u0027serial_wq\u0027 and put \u0027pd\u0027 ref until the \u0027serial_wq\u0027 finish.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.235\", \"versionStartIncluding\": \"5.6\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.179\", \"versionStartIncluding\": \"5.6\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.129\", \"versionStartIncluding\": \"5.6\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.76\", \"versionStartIncluding\": \"5.6\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12.13\", \"versionStartIncluding\": \"5.6\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.13.2\", \"versionStartIncluding\": \"5.6\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.14\", \"versionStartIncluding\": \"5.6\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"5.4.19\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"5.5.3\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:53:59.161Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-21726\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:53:59.161Z\", \"dateReserved\": \"2024-12-29T08:45:45.754Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2025-02-27T02:07:32.861Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.