CVE-2025-21786

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-21786", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-12-29T08:45:45.765Z", "datePublished": "2025-02-27T02:18:26.406Z", "dateUpdated": "2026-08-05T11:54:24.903Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:54:24.903Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nworkqueue: Put the pwq after detaching the rescuer from the pool\n\nThe commit 68f83057b913(\"workqueue: Reap workers via kthread_stop() and\nremove detach_completion\") adds code to reap the normal workers but\nmistakenly does not handle the rescuer and also removes the code waiting\nfor the rescuer in put_unbound_pool(), which caused a use-after-free bug\nreported by Cheung Wall.\n\nTo avoid the use-after-free bug, the pool\u2019s reference must be held until\nthe detachment is complete. Therefore, move the code that puts the pwq\nafter detaching the rescuer from the pool."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerability is in the core workqueue rescuer path and is reached by generating local workqueue load and memory pressure; there is no remote input path into `rescuer_thread()`. Exploitation requires the attacker to be executing code on the system.\nAC:L - The attacker fully controls the side of the race that matters \u2014 sustained memory pressure plus queued work on an unbound `WQ_MEM_RECLAIM` workqueue drives `pool_mayday_timeout()`/`send_mayday()` at will and can be looped indefinitely, so the narrow window between `put_pwq()` and `worker_detach_from_pool()` can be retried unboundedly until the RCU free lands first.\nPR:L - Any unprivileged local user can create the required conditions \u2014 allocating memory to stall `create_worker()` and issuing filesystem/block/network I/O that queues work on unbound `WQ_MEM_RECLAIM` workqueues (ext4-rsv-conversion, xfs, nfsiod, rpciod, scsi hosts). No capability check guards the rescuer path.\nUI:N - The rescuer is summoned automatically by the workqueue watchdog timer under memory pressure; no action by any other user or administrator-victim is needed to complete the attack.\nS:U - The freed object and the corruption both live in kernel heap memory within the same security authority; there is no VM, IOMMU, or sandbox boundary crossed.\nC:H - The freed `struct worker_pool` is read after free (`pool->flags`, `worker->node` list pointers) and comes from a generic kmalloc cache, so a reallocated victim object leaks its contents through the rescuer's list manipulation, giving a path to arbitrary kernel memory disclosure.\nI:H - `detach_worker()`'s `list_del(&worker->node)` performs a write-after-free of kernel pointers at the fixed offset of `pool->workers` into the freed slab object, which after heap spraying yields a controlled-offset write primitive usable for control-flow hijack and privilege escalation.\nA:H - Use-after-free on the worker pool corrupts the attached-workers list and typically produces an immediate oops/panic (KASAN reported it as a UAF), permanently wedging or crashing the kernel."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/workqueue.c"], "versions": [{"version": "68f83057b913467a999e1bf9e0da6a119668f769", "lessThan": "e7c16028a424dd35be1064a68fa318be4359310f", "status": "affected", "versionType": "git"}, {"version": "68f83057b913467a999e1bf9e0da6a119668f769", "lessThan": "835b69c868f53f959d4986bbecd561ba6f38e492", "status": "affected", "versionType": "git"}, {"version": "68f83057b913467a999e1bf9e0da6a119668f769", "lessThan": "e76946110137703c16423baf6ee177b751a34b7e", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/workqueue.c"], "versions": [{"version": "6.11", "status": "affected"}, {"version": "0", "lessThan": "6.11", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.16", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.13.4", "lessThanOrEqual": "6.13.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.14", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11", "versionEndExcluding": "6.12.16"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11", "versionEndExcluding": "6.13.4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11", "versionEndExcluding": "6.14"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/e7c16028a424dd35be1064a68fa318be4359310f"}, {"url": "https://git.kernel.org/stable/c/835b69c868f53f959d4986bbecd561ba6f38e492"}, {"url": "https://git.kernel.org/stable/c/e76946110137703c16423baf6ee177b751a34b7e"}], "title": "workqueue: Put the pwq after detaching the rescuer from the pool", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-21786", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-02-27T18:14:15.335144Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-416", "description": "CWE-416 Use After Free"}]}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-27T18:22:29.313Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-21786", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-02-27T18:14:15.335144Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-416", "description": "CWE-416 Use After Free"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-27T18:14:16.659Z"}}], "cna": {"title": "workqueue: Put the pwq after detaching the rescuer from the pool", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerability is in the core workqueue rescuer path and is reached by generating local workqueue load and memory pressure; there is no remote input path into `rescuer_thread()`. Exploitation requires the attacker to be executing code on the system.\nAC:L - The attacker fully controls the side of the race that matters \u2014 sustained memory pressure plus queued work on an unbound `WQ_MEM_RECLAIM` workqueue drives `pool_mayday_timeout()`/`send_mayday()` at will and can be looped indefinitely, so the narrow window between `put_pwq()` and `worker_detach_from_pool()` can be retried unboundedly until the RCU free lands first.\nPR:L - Any unprivileged local user can create the required conditions \u2014 allocating memory to stall `create_worker()` and issuing filesystem/block/network I/O that queues work on unbound `WQ_MEM_RECLAIM` workqueues (ext4-rsv-conversion, xfs, nfsiod, rpciod, scsi hosts). No capability check guards the rescuer path.\nUI:N - The rescuer is summoned automatically by the workqueue watchdog timer under memory pressure; no action by any other user or administrator-victim is needed to complete the attack.\nS:U - The freed object and the corruption both live in kernel heap memory within the same security authority; there is no VM, IOMMU, or sandbox boundary crossed.\nC:H - The freed `struct worker_pool` is read after free (`pool->flags`, `worker->node` list pointers) and comes from a generic kmalloc cache, so a reallocated victim object leaks its contents through the rescuer's list manipulation, giving a path to arbitrary kernel memory disclosure.\nI:H - `detach_worker()`'s `list_del(&worker->node)` performs a write-after-free of kernel pointers at the fixed offset of `pool->workers` into the freed slab object, which after heap spraying yields a controlled-offset write primitive usable for control-flow hijack and privilege escalation.\nA:H - Use-after-free on the worker pool corrupts the attached-workers list and typically produces an immediate oops/panic (KASAN reported it as a UAF), permanently wedging or crashing the kernel."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "68f83057b913467a999e1bf9e0da6a119668f769", "lessThan": "e7c16028a424dd35be1064a68fa318be4359310f", "versionType": "git"}, {"status": "affected", "version": "68f83057b913467a999e1bf9e0da6a119668f769", "lessThan": "835b69c868f53f959d4986bbecd561ba6f38e492", "versionType": "git"}, {"status": "affected", "version": "68f83057b913467a999e1bf9e0da6a119668f769", "lessThan": "e76946110137703c16423baf6ee177b751a34b7e", "versionType": "git"}], "programFiles": ["kernel/workqueue.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.11"}, {"status": "unaffected", "version": "0", "lessThan": "6.11", "versionType": "semver"}, {"status": "unaffected", "version": "6.12.16", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.13.4", "versionType": "semver", "lessThanOrEqual": "6.13.*"}, {"status": "unaffected", "version": "6.14", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["kernel/workqueue.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/e7c16028a424dd35be1064a68fa318be4359310f"}, {"url": "https://git.kernel.org/stable/c/835b69c868f53f959d4986bbecd561ba6f38e492"}, {"url": "https://git.kernel.org/stable/c/e76946110137703c16423baf6ee177b751a34b7e"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nworkqueue: Put the pwq after detaching the rescuer from the pool\n\nThe commit 68f83057b913(\"workqueue: Reap workers via kthread_stop() and\nremove detach_completion\") adds code to reap the normal workers but\nmistakenly does not handle the rescuer and also removes the code waiting\nfor the rescuer in put_unbound_pool(), which caused a use-after-free bug\nreported by Cheung Wall.\n\nTo avoid the use-after-free bug, the pool\u2019s reference must be held until\nthe detachment is complete. Therefore, move the code that puts the pwq\nafter detaching the rescuer from the pool."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.16", "versionStartIncluding": "6.11"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.13.4", "versionStartIncluding": "6.11"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.14", "versionStartIncluding": "6.11"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:54:24.903Z"}}}, "cveMetadata": {"cveId": "CVE-2025-21786", "state": "PUBLISHED", "dateUpdated": "2026-08-05T11:54:24.903Z", "dateReserved": "2024-12-29T08:45:45.765Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2025-02-27T02:18:26.406Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["kernel/workqueue.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "e7c16028a424dd35be1064a68fa318be4359310f", "status": "affected", "version": "68f83057b913467a999e1bf9e0da6a119668f769", "versionType": "git"}, {"lessThan": "835b69c868f53f959d4986bbecd561ba6f38e492", "status": "affected", "version": "68f83057b913467a999e1bf9e0da6a119668f769", "versionType": "git"}, {"lessThan": "e76946110137703c16423baf6ee177b751a34b7e", "status": "affected", "version": "68f83057b913467a999e1bf9e0da6a119668f769", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["kernel/workqueue.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.11"}, {"lessThan": "6.11", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.16", "versionType": "semver"}, {"lessThanOrEqual": "6.13.*", "status": "unaffected", "version": "6.13.4", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.14", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "78A007D8-96E2-42F8-AAA7-55F22F10F891", "versionEndExcluding": "6.12.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "2A2093ED-74A9-43F9-AC72-50030F374EA4", "versionEndExcluding": "6.13.4", "versionStartIncluding": "6.13", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nworkqueue: Put the pwq after detaching the rescuer from the pool\n\nThe commit 68f83057b913(\"workqueue: Reap workers via kthread_stop() and\nremove detach_completion\") adds code to reap the normal workers but\nmistakenly does not handle the rescuer and also removes the code waiting\nfor the rescuer in put_unbound_pool(), which caused a use-after-free bug\nreported by Cheung Wall.\n\nTo avoid the use-after-free bug, the pool\u2019s reference must be held until\nthe detachment is complete. Therefore, move the code that puts the pwq\nafter detaching the rescuer from the pool."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: workqueue: colocar el pwq despu\u00e9s de separar el rescatador del grupo el commit 68f83057b913(\"workqueue: Reap workers via kthread_stop() and remove detach_completion\") agrega c\u00f3digo para recolectar los trabajadores normales, pero por error no gestiona el rescatador y tambi\u00e9n elimina el c\u00f3digo que espera al rescatador en put_unbound_pool(), lo que caus\u00f3 un error de use after free informado por Cheung Wall. Para evitar el error de use after free, la referencia del grupo debe mantenerse hasta que se complete la separaci\u00f3n. Por lo tanto, mueva el c\u00f3digo que coloca el pwq despu\u00e9s de separar el rescatador del grupo."}], "id": "CVE-2025-21786", "lastModified": "2026-06-17T08:44:16.453", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-21786", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-02-27T18:14:15.335144Z", "version": "2.0.3"}}]}, "published": "2025-02-27T03:15:19.450", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/835b69c868f53f959d4986bbecd561ba6f38e492"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/e76946110137703c16423baf6ee177b751a34b7e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/e7c16028a424dd35be1064a68fa318be4359310f"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "kernel: workqueue: Put the pwq after detaching the rescuer from the pool", "id": "2348587", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2348587"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.8", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-416", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nworkqueue: Put the pwq after detaching the rescuer from the pool\nThe commit 68f83057b913(\"workqueue: Reap workers via kthread_stop() and\nremove detach_completion\") adds code to reap the normal workers but\nmistakenly does not handle the rescuer and also removes the code waiting\nfor the rescuer in put_unbound_pool(), which caused a use-after-free bug\nreported by Cheung Wall.\nTo avoid the use-after-free bug, the pool\u2019s reference must be held until\nthe detachment is complete. Therefore, move the code that puts the pwq\nafter detaching the rescuer from the pool.", "A vulnerability was found in the Linux kernel's work queue subsystem, which manages background task execution. The issue stems from improper handling of the \"rescuer\" thread during the cleanup of unbound work queues."], "name": "CVE-2025-21786", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Will not fix", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-02-27T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-21786\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-21786\nhttps://lore.kernel.org/linux-cve-announce/2025022608-CVE-2025-21786-f31d@gregkh/T"], "statement": "Red Hat Product Security classifies this bug as Moderate based on the following reasons:\n* Workqueues are not accessible to unprivileged users, such as SELinux lockdown. \n* Local access is required for this bug to work.", "threat_severity": "Moderate"}

{}