- 7.1HighCVSS base score
- 0.17%Exploitation in 30 daysEPSS · top 93% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: rcu: Fix rcu_read_unlock() deadloop due to IRQ work During rcu_read_unlock_special(), if this happens during irq_exit(), we can lockup if an IPI is issued. This is because the IPI itself triggers the irq_exit() path causing a recursive lock up. This is precisely what Xiongfeng found when invoking a BPF program on the trace_tick_stop() tracepoint As shown in the trace below. Fix by managing the irq_work state correctly. irq_exit() __irq_exit_rcu() /* in_hardirq() returns false after this */ preempt_count_sub(HARDIRQ_OFFSET) tick_irq_exit() tick_nohz_irq_exit() tick_nohz_stop_sched_tick() trace_tick_stop() /* a bpf prog is hooked on this trace point */ __bpf_trace_tick_stop() bpf_trace_run2() rcu_read_unlock_special() /* will send a IPI to itself */ irq_work_queue_on(&rdp->defer_qs_iw, rdp->cpu); A simple reproducer can also be obtained by doing the following in tick_irq_exit(). It will hang on boot without the patch: static inline void tick_irq_exit(void) { + rcu_read_lock(); + WRITE_ONCE(current->rcu_read_unlock_special.b.need_qs, true); + rcu_read_unlock(); + [neeraj: Apply Frederic's suggested fix for PREEMPT_RT]
Timeline
ID reserved
By Linux
- 5 months later
· 5 months later
Published
- 14 months later
· 14 months later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| NVDNVD · Modified | 3.1 | High7.1 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H |
- EPSS (exploitation in 30 days)
- 0.17% · top 93% of all CVEs (11 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.1.
Affected products
- affected 0864f057b050bc6dd68106b3185e02db5140012d – < 6b552ffd21f9be57806ade167a757f32dd66a98d
- affected 0864f057b050bc6dd68106b3185e02db5140012d – < e7a375453cca2b8a0d2fa1b82b913f3fed7c0507
- affected 0864f057b050bc6dd68106b3185e02db5140012d – < 1cfa244f7198d325594e627574930b7b91df5bfe
- affected 0864f057b050bc6dd68106b3185e02db5140012d – < ddebb2a7677673cf4438a04e1a48b8ed6b0c8e9a
- affected 0864f057b050bc6dd68106b3185e02db5140012d – < 56c5ef194f4509df63fc0f7a91ea5973ce479b1e
- affected 0864f057b050bc6dd68106b3185e02db5140012d – < b41642c87716bbd09797b1e4ea7d904f06c39b7b
- affected 5.3
- unaffected < 5.3
- unaffected 6.1.191 – ≤ 6.1.*
- unaffected 6.6.103 – ≤ 6.6.*
- unaffected 6.12.43 – ≤ 6.12.*
- unaffected 6.15.11 – ≤ 6.15.*
- unaffected 6.16.2 – ≤ 6.16.*
- unaffected 6.17 – ≤ *
References
References6
- https://git.kernel.org/stable/c/6b552ffd21f9be57806ade167a757f32dd66a98d (opens in a new tab)
- https://git.kernel.org/stable/c/e7a375453cca2b8a0d2fa1b82b913f3fed7c0507 (opens in a new tab)
- https://git.kernel.org/stable/c/1cfa244f7198d325594e627574930b7b91df5bfe (opens in a new tab)
- https://git.kernel.org/stable/c/ddebb2a7677673cf4438a04e1a48b8ed6b0c8e9a (opens in a new tab)
- https://git.kernel.org/stable/c/56c5ef194f4509df63fc0f7a91ea5973ce479b1e (opens in a new tab)
- https://git.kernel.org/stable/c/b41642c87716bbd09797b1e4ea7d904f06c39b7b (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2025-28967 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2025-39744)Record last updated .