CVE-2025-38584 Linux CVE debrief

Who should care

Linux kernel maintainers, distribution security teams, embedded/OEM kernel integrators, and administrators running affected Linux kernel releases should care. Systems that use or expose the padata code path are the most relevant to review.

Technical summary

The issue is a race condition leading to a use-after-free in padata_reorder. The CVE description states that a reference count is taken in padata_do_parallel and released in padata_serial_worker, and that padata_replace depends on this reference count. In padata_reorder, once padata is added to queue->serial.list and the spin lock is released, the associated pd can be processed and freed before the next step completes. The fix moves acquisition of the next padata earlier, before releasing the squeue->serial lock, and restructures the reorder logic so it is called only when the next padata is available.

Defensive priority

High. This is a kernel memory-safety issue with local attack prerequisites and high potential impact, and NVD lists it as affecting widely deployed Linux kernel version ranges.

Recommended defensive actions

• Apply the kernel updates that include the padata_reorder fix from the referenced stable branches.
• Prioritize patching systems running Linux kernel versions in the NVD-affected ranges: 2.6.34 through before 6.15.10, and 6.16 through before 6.16.1.
• Verify whether your kernels or downstream vendor builds include the stable patch references linked in the source data.
• Treat affected hosts as high priority if they use padata-related functionality or vendor kernels derived from the impacted upstream releases.
• Use your normal kernel update and reboot process to ensure the fix is actually running, not just staged.

Evidence notes

Based only on the supplied CVE description and NVD metadata. The CVE text identifies a long-standing race/use-after-free in padata_reorder and describes the fix. NVD assigns CWE-416 and CVSS v3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, and lists affected Linux kernel version ranges as 2.6.34 through before 6.15.10 and 6.16 through before 6.16.1. The supplied source references include kernel.org stable patch links.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.