CVE-2026-53314

padata: Put CPU offline callback in ONLINE section to allow failure

published June 26, 2026

CVSS
—
EPSS
0%
Percentile
1.7
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

padata: Put CPU offline callback in ONLINE section to allow failure

syzbot reported the following warning:

DEAD callback error for CPU1

WARNING: kernel/cpu.c:1463 at _cpu_down+0x759/0x1020 kernel/cpu.c:1463, CPU#0: syz.0.1960/14614

at commit 4ae12d8bd9a8 ("Merge tag 'kbuild-fixes-7.0-2' of git://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux")

which tglx traced to padata_cpu_dead() given it's the only

sub-CPUHP_TEARDOWN_CPU callback that returns an error.

Failure isn't allowed in hotplug states before CPUHP_TEARDOWN_CPU

so move the CPU offline callback to the ONLINE section where failure is

possible.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00118 · 1.7th percentile
Published
2026-06-26T19:41Z
EPSS history
Timeline
  • 26 JUN 19:41Z
    padata: Put CPU offline callback in ONLINE section to allow failure
    cvelistv5