In the Linux kernel, the following vulnerability has been resolved:
rcu/nocb: Fix possible invalid rdp's->nocbcbkthread pointer access
In the preparation stage of CPU online, if the corresponding the rdp's->nocbcbkthread does not exist, will be created, there is a situation where the rdp's rcuop kthreads creation fails, and then de-offload this CPU's rdp, does not assign this CPU's rdp->nocbcbkthread pointer, but this rdp's->nocbgprdp and rdp's->rdpgp->nocbgp_kthread is still valid.
This will cause the subsequent re-offload operation of this offline CPU, which will pass the conditional check and the kthreadunpark() will access invalid rdp's->nocbcb_kthread pointer.
This commit therefore use rdp's->nocbgpkthread instead of rdpgp's->nocbgp_kthread for safety check.
[
{
"id": "CVE-2025-38704-03addc2d",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"133642397809991958302552221700087865635",
"147325149872204746806206622544924082218",
"31801319549046358411901299869881987473",
"76512860352070648069531721816053743185",
"178884113557672718333619592461804252728",
"119151582017437731536284840933859066389",
"233937273420247243865454726820442521553",
"97956414908288285164601842007237088010",
"154348578942470974188427050446256650283",
"237698887048733256112743570578378091536",
"132227171321988049250602870445868608933",
"114418034320907170841813901504688983368"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9b5ec8e6b31755288a07b3abeeab8cd38e9d3c9d",
"target": {
"file": "kernel/rcu/tree_nocb.h"
}
},
{
"id": "CVE-2025-38704-048e2a78",
"signature_version": "v1",
"digest": {
"function_hash": "239453587482016703349335349465981317649",
"length": 575.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9b5ec8e6b31755288a07b3abeeab8cd38e9d3c9d",
"target": {
"file": "kernel/rcu/tree_nocb.h",
"function": "rcu_nocb_rdp_offload"
}
},
{
"id": "CVE-2025-38704-05aeccdb",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"133642397809991958302552221700087865635",
"147325149872204746806206622544924082218",
"31801319549046358411901299869881987473",
"76512860352070648069531721816053743185",
"178884113557672718333619592461804252728",
"119151582017437731536284840933859066389",
"233937273420247243865454726820442521553",
"97956414908288285164601842007237088010",
"154348578942470974188427050446256650283",
"237698887048733256112743570578378091536",
"132227171321988049250602870445868608933",
"114418034320907170841813901504688983368"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1c951683a720b17c9ecaad1932bc95b29044611f",
"target": {
"file": "kernel/rcu/tree_nocb.h"
}
},
{
"id": "CVE-2025-38704-125c28b6",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"133642397809991958302552221700087865635",
"147325149872204746806206622544924082218",
"31801319549046358411901299869881987473",
"76512860352070648069531721816053743185",
"178884113557672718333619592461804252728",
"119151582017437731536284840933859066389",
"233937273420247243865454726820442521553",
"97956414908288285164601842007237088010",
"154348578942470974188427050446256650283",
"237698887048733256112743570578378091536",
"132227171321988049250602870445868608933",
"114418034320907170841813901504688983368"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cce3d027227c69e85896af9fbc6fa9af5c68f067",
"target": {
"file": "kernel/rcu/tree_nocb.h"
}
},
{
"id": "CVE-2025-38704-3aeed2b6",
"signature_version": "v1",
"digest": {
"function_hash": "239453587482016703349335349465981317649",
"length": 575.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cce3d027227c69e85896af9fbc6fa9af5c68f067",
"target": {
"file": "kernel/rcu/tree_nocb.h",
"function": "rcu_nocb_rdp_offload"
}
},
{
"id": "CVE-2025-38704-ac2d3381",
"signature_version": "v1",
"digest": {
"function_hash": "239453587482016703349335349465981317649",
"length": 575.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1c951683a720b17c9ecaad1932bc95b29044611f",
"target": {
"file": "kernel/rcu/tree_nocb.h",
"function": "rcu_nocb_rdp_offload"
}
},
{
"id": "CVE-2025-38704-b76d92b1",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"133642397809991958302552221700087865635",
"147325149872204746806206622544924082218",
"31801319549046358411901299869881987473",
"76512860352070648069531721816053743185",
"178884113557672718333619592461804252728",
"119151582017437731536284840933859066389",
"233937273420247243865454726820442521553",
"97956414908288285164601842007237088010",
"154348578942470974188427050446256650283",
"237698887048733256112743570578378091536",
"132227171321988049250602870445868608933",
"114418034320907170841813901504688983368"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1bba3900ca18bdae28d1b9fa10f16a8f8cb2ada1",
"target": {
"file": "kernel/rcu/tree_nocb.h"
}
},
{
"id": "CVE-2025-38704-ba6f645e",
"signature_version": "v1",
"digest": {
"function_hash": "239453587482016703349335349465981317649",
"length": 575.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1bba3900ca18bdae28d1b9fa10f16a8f8cb2ada1",
"target": {
"file": "kernel/rcu/tree_nocb.h",
"function": "rcu_nocb_rdp_offload"
}
}
]