[CBR 7.9] CVE-2025-21786

[pvts-mat]

[CBR 7.9]
CVE-2025-21786
VULN-54089

Problem

https://access.redhat.com/security/cve/CVE-2025-21786

A vulnerability was found in the Linux kernel's work queue subsystem, which manages background task execution. The issue stems from improper handling of the "rescuer" thread during the cleanup of unbound work queues.

Applicability: no

As it was explained in the analysis of the CVE-2025-21786's fix in #406, the key to avoiding the use-after-free condition was reordering the calls of put_pwq(…) and worker_detach_from_pool(…). As long as put_pwq(…) occured before worker_detach_from_pool(…) it was possible for the work pool to reach 0 ref counts and be destroyed by RCU mechanism before worker_detach_from_pool(…) call that required the pool to still be present. In ciqcbr7_9 however, the worker_detach_from_pool(…) call doesn't even exist yet. The pool attachment / detachment scheme was introduced in 51697d3, which is missing from ciqcbr7_9's history. This means that CBR 7.9 not only doesn't contain the code introducing the bug (68f8305), but even the code which this bug would require to manifest. Unlike the worker_attach_to_pool(…) / worker_detach_from_pool(…) scheme, the synchronization mechanism used before - the worker_maybe_bind_and_lock(…) function - does not follow similar "attach" / "detach" scheme, so it's hard to even pinpoint the worker_detach_from_pool(…) analogue and evaluate whether it follows proper ordering in relation to put_pwq(…).

Taking this into account it was assessed that CVE-2025-21786 does not apply to CBR 7.9.

[pvts-mat]

The "draft" status is only to prevent accidental merge, the PR is ready for review.