CVE-2025-21786

What it actually does

Use-after-free in Linux kernel workqueue due to missing pool reference during rescuer detachment after normal worker reaping was introduced.

Why it matters to the business

Linux systems may experience kernel instability, crashes, or potential privilege escalation, increasing risk for servers, containers, and embedded devices that rely on the affected kernel versions.

How an attack unfolds

An attacker triggers workqueue operations that cause the rescuer to be detached after the pool is freed, then reuses the dangling reference to corrupt memory or execute code; related kernel privilege escalation techniques seen in similar issues may be adapted.

How to fix it

Upgrade the Linux kernel to commit e7c16028a424dd35be1064a68fa318be4359310f or later stable releases that include the fix moving the pwq put after rescuer detachment.

How to confirm the fix worked

Verify the running kernel contains commit e7c16028a424dd35be1064a68fa318be4359310f; inspect workqueue.c for the corrected put order after rescuer detachment; test with targeted workqueue stress workloads.

Typical attack path

1. Identify a workload or syscall sequence that exercises unbound workqueues with rescuers
2. Trigger worker reaping path introduced by the referenced commit
3. Force rescuer detachment after pool put but before reference is safely released
4. Reuse freed pool structure via subsequent allocations to achieve memory corruption or control flow hijack

How to detect it

Review kernel logs for workqueue-related oops or use-after-free warnings; correlate with processes triggering rescuer paths; watch for unexpected kthread or pool structures in crash dumps.

What your security team should do

• Apply the fixed kernel commit immediately on all affected systems
• Prioritize updates for internet-facing or multi-tenant Linux hosts
• Monitor vendor advisories for backported patches in distribution kernels
• Enable kernel hardening features such as KASAN or lockdown mode during testing