CVE-2025-21727

What it actually does

Use-after-free in padata_reorder allows reading from a freed pd structure via padata_find_next after reference count drops during algorithm deletion under RCU-protected paths.

Why it matters to the business

Local attackers can achieve privilege escalation on Linux systems affecting 98 downstream dependents, increasing risk of full system compromise with low but persistent exploit likelihood.

How an attack unfolds

Attacker runs workloads triggering pcrypt_aead_encrypt and padata_do_parallel to increment refcnt, then deletes the algorithm to invoke padata_put_pd and free the pd while padata_reorder's while loop still calls padata_find_next, causing UAF; similar patterns seen in other kernel privilege escalation campaigns.

How to fix it

Add synchronize_rcu() call inside padata_free_shell to wait for in-flight do_serial operations; upgrade affected tensorflow packages to 2.8.4 where kernel components are vendored.

How to confirm the fix worked

Reproduce with LTP pcrypt_aead01 test under KASAN, confirm absence of slab-use-after-free reports in padata_find_next, and verify synchronize_rcu presence in padata_free_shell.

Typical attack path

1. Trigger parallel crypto operation via padata_do_parallel to hold reference
2. Initiate algorithm deletion to decrement refcnt to zero
3. Enter padata_reorder while loop and call padata_find_next on now-freed pd
4. Read attacker-controlled or kernel memory leading to escalation

How to detect it

Search kernel logs and KASAN reports for padata_find_next, padata_reorder, and slab-use-after-free mentions during pdecrypt_parallel workqueue activity; correlate with algorithm deletion events.

• BUG: KASAN: slab-use-after-free in padata_find_next+0x29/0x1a0
• Workqueue: pdecrypt_parallel padata_parallel_worker
• padata_reorder+0x131/0x220
• Read of size 4 at addr ffff88bbfe003524

What your security team should do

• Immediately update Linux kernels and tensorflow 2.8.4 deployments given 98 downstream dependents
• Enable KASAN or similar memory debugging in test environments to catch UAF patterns
• Monitor workqueues involving pdecrypt_parallel for anomalous crashes
• Review RCU-protected paths in any custom padata users