Affected: Linux

In the Linux kernel, the following vulnerability has been resolved:

padata: Fix refcnt handling in padata_free_shell()

In a high-load arm64 environment, the pcrypt_aead01 test in LTP can lead to system UAF (Use-After-Free) issues. Due to the lengthy analysis of the pcrypt_aead01 function call, I'll describe the problem scenario using a simplified model:

Suppose there's a user of padata named `user_function` that adheres to the padata requirement of calling `padata_free_shell` after `serial()` has been invoked, as demonstrated in the following code:

```c struct request { struct padata_priv padata; struct completion *done; };

void parallel(struct padata_priv *padata) { do_something(); }

void serial(struct padata_priv *padata) { struct request *request = container_of(padata, struct request, padata); complete(request->done); }

void user_function() { DECLARE_COMPLETION(done) padata->parallel = parallel; padata->serial = serial; padata_do_parallel(); wait_for_completion(&done); padata_free_shell(); } ```

In the corresponding padata.c file, there's the following code:

```c static void padata_serial_worker(struct work_struct *serial_work) { ... cnt = 0;

while (!list_empty(&local_list)) { ... padata->serial(padata); cnt++; }

local_bh_enable();

if (refcount_sub_and_test(cnt, &pd->refcnt)) padata_free_pd(pd); } ```

Because of the high system load and the accumula…

Affected: Ubuntu:Pro:18.04:LTS: linux-aws-5.4, Ubuntu:Pro:18.04:LTS: linux-gcp-5.4, Ubuntu:Pro:18.04:LTS: linux-hwe-5.4, Ubuntu:Pro:18.04:LTS: linux-ibm-5.4, Ubuntu:Pro:18.04:LTS: linux-oracle-5.4, Ubuntu:Pro:18.04:LTS: linux-raspi-5.4, Ubuntu:Pro:20.04:LTS: linux, Ubuntu:Pro:20.04:LTS: linux-aws, Ubuntu:Pro:20.04:LTS: linux-gcp, Ubuntu:Pro:20.04:LTS: linux-ibm and 4 more

Jean-Claude Graf, Sandro Rüegge, Ali Hajiabadi, and Kaveh Razavi discovered that the Linux kernel contained insufficient branch predictor isolation between a guest and a userspace hypervisor for certain processors. This flaw is known as VMSCAPE. An attacker in a guest VM could possibly use this to expose sensitive information from the host OS. (CVE-2025-40300)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - HSI subsystem; - I3C subsystem; - SMB network file system; - Padata parallel execution mechanism; - Timer subsystem; - Networking core; (CVE-2023-52854, CVE-2024-35867, CVE-2024-50061, CVE-2024-56664, CVE-2025-21727, CVE-2025-37838, CVE-2025-38352)