CVE-2025-21726

What it actually does

Use-after-free vulnerability in Linux kernel padata reorder_work allowing a freed pd structure to be accessed during serial worker execution after crypto_del_alg frees it via a race with new request queuing.

Why it matters to the business

Local attackers on affected Linux systems could escalate privileges or cause crashes disrupting operations; low urgency due to stable low EPSS, no KEV listing, and no ransomware association despite high CVSS.

How an attack unfolds

Attacker triggers concurrent padata_do_serial and crypto_del_alg operations creating a window where reorder_work is queued after pd free; kworker then invokes padata_reorder on the dangling pd reference leading to memory corruption.

How to fix it

Upgrade affected apache-airflow (PyPI) packages to version 1.10.5 or later; apply equivalent upstream Linux kernel patches addressing padata UAF in reorder_work for kernel-based deployments.

How to confirm the fix worked

Confirm package versions meet or exceed 1.10.5; review kernel source for pd reference count taken before queuing reorder_work to serial_wq and released only after completion.

Typical attack path

1. Obtain local code execution on target Linux system
2. Trigger parallel crypto algorithm operations and deletion to race padata reorder path
3. Queue reorder_work after pd is freed but before serial worker completes
4. Force kworker execution of invoke_padata_reorder on freed memory
5. Achieve kernel memory corruption for privilege escalation

How to detect it

Search kernel logs and audit trails for padata_reorder and crypto_del_alg sequences around crashes or unexpected privilege changes; correlate with kworker activity involving serial_wq.

What your security team should do

• Prioritize patching systems with local user access or crypto workloads within standard maintenance windows given low EPSS
• Monitor for related Linux kernel privilege escalation activity listed in threat actor context
• Audit local privilege boundaries and restrict untrusted code execution where possible