CVE-2025-21786
Severity CVSS v4.0:
Pending analysis
Type:
CWE-416
Use After Free
Publication date:
27/02/2025
Last modified:
21/03/2025
Description
In the Linux kernel, the following vulnerability has been resolved:<br />
<br />
workqueue: Put the pwq after detaching the rescuer from the pool<br />
<br />
The commit 68f83057b913("workqueue: Reap workers via kthread_stop() and<br />
remove detach_completion") adds code to reap the normal workers but<br />
mistakenly does not handle the rescuer and also removes the code waiting<br />
for the rescuer in put_unbound_pool(), which caused a use-after-free bug<br />
reported by Cheung Wall.<br />
<br />
To avoid the use-after-free bug, the pool’s reference must be held until<br />
the detachment is complete. Therefore, move the code that puts the pwq<br />
after detaching the rescuer from the pool.
Impact
Base Score 3.x
7.80
Severity 3.x
HIGH
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 6.12.16 (excluding) | |
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 6.13 (including) | 6.13.4 (excluding) |
To consult the complete list of CPE names with products and versions, see this page