CVE-2025-38704

CVE-2025-38704

High · published September 4, 2025

CVSS v3.1
7.8
EPSS
0%
Percentile
7.4
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer access

In the preparation stage of CPU online, if the corresponding

the rdp's->nocb_cb_kthread does not exist, will be created,

there is a situation where the rdp's rcuop kthreads creation fails,

and then de-offload this CPU's rdp, does not assign this CPU's

rdp->nocb_cb_kthread pointer, but this rdp's->nocb_gp_rdp and

rdp's->rdp_gp->nocb_gp_kthread is still valid.

This will cause the subsequent re-offload operation of this offline

CPU, which will pass the conditional check and the kthread_unpark()

will access invalid rdp's->nocb_cb_kthread pointer.

This commit therefore use rdp's->nocb_gp_kthread instead of

rdp_gp's->nocb_gp_kthread for safety check.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00182 · 7.4th percentile
Published
2025-09-04T20:15Z
Affected products (3)
ProductVersionsFixed in
linux/linux_kernel< 6.12.436.12.43
linux/linux_kernel≥ 6.13, < 6.15.116.15.11
linux/linux_kernel≥ 6.16, < 6.16.26.16.2
References (10)
EPSS history
Timeline
  • 04 SEP 15:32Z
    rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer access
    cvelistv5