CVE-2025-21726

A flaw was found in the Linux kernel's parallel execution mechanism (padata). A race condition between cryptographic request processing and algorithm removal can cause a use-after-free (accessing memory after it has been released) condition during work reordering. A local user could exploit this vulnerability to trigger a denial of service (DoS) through a system crash or potentially cause memory corruption.

There is no known way to trigger the bug. This is a purely theroretical concern, the problem has never been actually observed -- it would require multiple pcrypt request submissions racing against each other, ultimately a pcrypt instance destruction (DELALG) short after request completions as well as unfortunate timing. As result of this observation keeping impact level Moderate (based on that attack complexity is high).

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.