CVE-2025-38031

Q: What is the severity of CVE-2025-38031?

CVE-2025-38031 has a CVSS score of 5.5 (MEDIUM). This CVE describes a reference count leak vulnerability in the Linux kernel's padata subsystem. When queue_work() fails to queue a work item because it's already queued, the parallel_data refcount is incremented but never decremented, leading to a memory leak. This affects Linux systems using the padata subsystem, typically for cryptographic operations.

5.5 MEDIUM

📋 TL;DR

This CVE describes a reference count leak vulnerability in the Linux kernel's padata subsystem. When queue_work() fails to queue a work item because it's already queued, the parallel_data refcount is incremented but never decremented, leading to a memory leak. This affects Linux systems using the padata subsystem, typically for cryptographic operations.

💻 Affected Systems

Products:

Linux kernel

Versions: Specific affected kernel versions not specified in CVE description, but references indicate patches for stable branches

Operating Systems: Linux distributions using vulnerable kernel versions

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects systems using the padata subsystem, which is typically used for parallel cryptographic operations. The cryptomgr_probe process mentioned in the backtrace suggests cryptographic module loading scenarios.

📦 What is this software?

Debian Linux by Debian

View all CVEs affecting Debian Linux →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Sustained exploitation could lead to kernel memory exhaustion, causing system instability, crashes, or denial of service.

🟠

Likely Case

Memory leak that gradually consumes kernel memory over time, potentially leading to performance degradation or system instability.

🟢

If Mitigated

With proper monitoring and memory limits, impact is limited to potential performance issues rather than complete system failure.

🌐 Internet-Facing: LOW - This vulnerability requires local access to the padata subsystem and is not directly exploitable over the network.

🏢 Internal Only: MEDIUM - Local users or processes using padata functionality could trigger the memory leak, potentially affecting system stability.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: NO

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Exploitation requires triggering the specific code path in padata's reorder_work function. This is a memory leak rather than a code execution vulnerability.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Patches available in stable kernel branches (references show multiple stable commits)

Vendor Advisory: https://git.kernel.org/stable/c/1a426abdf1c86882c9203dd8182f3b8274b89938

Restart Required: Yes

Instructions:

1. Identify your Linux kernel version. 2. Check if patches are available for your distribution. 3. Update kernel package via package manager (apt, yum, dnf, etc.). 4. Reboot system to load new kernel.

🔧 Temporary Workarounds

Disable padata subsystem

linux

Remove or disable padata functionality if not required

echo 'blacklist padata' >> /etc/modprobe.d/blacklist.conf
rmmod padata

🧯 If You Can't Patch

Monitor kernel memory usage and system stability metrics
Restrict access to cryptographic operations that use padata subsystem

🔍 How to Verify

Check if Vulnerable:

Check kernel version and compare against patched versions. Examine if padata subsystem is loaded: lsmod | grep padata

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version after update matches patched version. Check system logs for memory leak indicators.

📡 Detection & Monitoring

Log Indicators:

Kernel memory allocation failures
System instability or crashes
High kernel memory usage in monitoring tools

Network Indicators:

None - this is a local kernel vulnerability

SIEM Query:

Search for kernel panic logs, out of memory errors, or process crashes related to cryptomgr_probe

📊 Metadata

CVE ID: CVE-2025-38031

CVSS v3 Score: 5.5 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS Score: 0.03% exploit probability (8.7th percentile)

Published: June 18, 2025

Last Updated: December 18, 2025

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Debian Linux by Debian

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Disable padata subsystem

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export