CVE-2025-38704

rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer access

State
Published
Severity
Not scored
Published
Sep 4, 2025
Updated
Oct 15, 2026
Reserved
Apr 16, 2025

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer access

In the preparation stage of CPU online, if the corresponding the rdp's->nocb_cb_kthread does not exist, will be created, there is a situation where the rdp's rcuop kthreads creation fails, and then de-offload this CPU's rdp, does not assign this CPU's rdp->nocb_cb_kthread pointer, but this rdp's->nocb_gp_rdp and rdp's->rdp_gp->nocb_gp_kthread is still valid.

This will cause the subsequent re-offload operation of this offline CPU, which will pass the conditional check and the kthread_unpark() will access invalid rdp's->nocb_cb_kthread pointer.

This commit therefore use rdp's->nocb_gp_kthread instead of rdp_gp's->nocb_gp_kthread for safety check.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 3a5761dc025da47960755ac64d9fbf1c32e8cd80 to before b097ae798298885695c339d390b48b4e39619fa7Affected
  • 3a5761dc025da47960755ac64d9fbf1c32e8cd80 to before 3da45ec1e485a1a5ad31fe9ddd467c7ee5ae4ef9Affected
  • 3a5761dc025da47960755ac64d9fbf1c32e8cd80 to before cce3d027227c69e85896af9fbc6fa9af5c68f067Affected
  • 3a5761dc025da47960755ac64d9fbf1c32e8cd80 to before 1c951683a720b17c9ecaad1932bc95b29044611fAffected
  • 3a5761dc025da47960755ac64d9fbf1c32e8cd80 to before 9b5ec8e6b31755288a07b3abeeab8cd38e9d3c9dAffected
  • 3a5761dc025da47960755ac64d9fbf1c32e8cd80 to before 1bba3900ca18bdae28d1b9fa10f16a8f8cb2ada1Affected
LinuxLinux
  • 6.0Affected
  • before 6.0Not affected
  • 6.1.167 through 6.1.*Not affected
  • 6.6.130 through 6.6.*Not affected
  • 6.12.43 through 6.12.*Not affected
  • 6.15.11 through 6.15.*Not affected
  • 6.16.2 through 6.16.*Not affected
  • 6.17 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.