In the Linux kernel, the following vulnerability has been resolved:
rcu: Fix rcureadunlock() deadloop due to IRQ work
During rcureadunlockspecial(), if this happens during irqexit(), we can lockup if an IPI is issued. This is because the IPI itself triggers the irq_exit() path causing a recursive lock up.
This is precisely what Xiongfeng found when invoking a BPF program on the tracetickstop() tracepoint As shown in the trace below. Fix by managing the irq_work state correctly.
irqexit() _irqexitrcu() /* inhardirq() returns false after this */ preemptcountsub(HARDIRQOFFSET) tickirqexit() ticknohzirqexit() ticknohzstopschedtick() tracetickstop() /* a bpf prog is hooked on this trace point */ _bpftracetickstop() bpftracerun2() rcureadunlockspecial() /* will send a IPI to itself */ irqworkqueueon(&rdp->deferqs_iw, rdp->cpu);
A simple reproducer can also be obtained by doing the following in tickirqexit(). It will hang on boot without the patch:
static inline void tickirqexit(void) { + rcureadlock(); + WRITEONCE(current->rcureadunlockspecial.b.needqs, true); + rcuread_unlock(); +
[neeraj: Apply Frederic's suggested fix for PREEMPT_RT]
[
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"function_hash": "26487935627914245297794936605043601225",
"length": 206.0
},
"id": "CVE-2025-39744-0728409a",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ddebb2a7677673cf4438a04e1a48b8ed6b0c8e9a",
"target": {
"file": "kernel/rcu/tree_plugin.h",
"function": "rcu_preempt_deferred_qs_handler"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"248127053304395159801114203277099886115",
"210620994110311210142881688876981774503",
"190148756675562889887515700666006732351",
"217486091757451679956403700471786834876",
"169879413884379341184353859978679368423",
"21648456997576052804352703915992674492",
"126008902910002815364916675629448699703",
"324238140497173308116358559029184806421",
"21985737292303801090159951087228385694",
"243472349916713243523195032704379237399",
"62700855463142360145376053520482616666",
"312882896047870446466505925888981342294",
"236038560222962776038777577013024831687",
"86965951805217094989309485356425974637",
"167020925418548721943700670118498243687",
"182453053255824443386670471774671529986",
"163796521000815467985856849434586161597",
"56550950249884089920462762358750411402",
"217577930934441446419732569268902453952",
"64970291896624684368145373263435702159",
"5138862212126175674731847901311289610"
]
},
"id": "CVE-2025-39744-087ac888",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e7a375453cca2b8a0d2fa1b82b913f3fed7c0507",
"target": {
"file": "kernel/rcu/tree_plugin.h"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"function_hash": "26487935627914245297794936605043601225",
"length": 206.0
},
"id": "CVE-2025-39744-0ae533a0",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b41642c87716bbd09797b1e4ea7d904f06c39b7b",
"target": {
"file": "kernel/rcu/tree_plugin.h",
"function": "rcu_preempt_deferred_qs_handler"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"function_hash": "26487935627914245297794936605043601225",
"length": 206.0
},
"id": "CVE-2025-39744-13800132",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1cfa244f7198d325594e627574930b7b91df5bfe",
"target": {
"file": "kernel/rcu/tree_plugin.h",
"function": "rcu_preempt_deferred_qs_handler"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"function_hash": "190641189426445345805043707751860395716",
"length": 1293.0
},
"id": "CVE-2025-39744-1419bc41",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ddebb2a7677673cf4438a04e1a48b8ed6b0c8e9a",
"target": {
"file": "kernel/rcu/tree_plugin.h",
"function": "rcu_read_unlock_special"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"53317365052084019700545308907320017459",
"179598365618244680663953403018185970121",
"212852304793197672854735272662084420419",
"204490644383161579968204985752748263750",
"274922945698605776140286847511868857975",
"198693885059848623485869535109539499039",
"317644354504155428780181597690844564630"
]
},
"id": "CVE-2025-39744-192078ca",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ddebb2a7677673cf4438a04e1a48b8ed6b0c8e9a",
"target": {
"file": "kernel/rcu/tree.h"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"function_hash": "190641189426445345805043707751860395716",
"length": 1293.0
},
"id": "CVE-2025-39744-288085ed",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1cfa244f7198d325594e627574930b7b91df5bfe",
"target": {
"file": "kernel/rcu/tree_plugin.h",
"function": "rcu_read_unlock_special"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"248127053304395159801114203277099886115",
"210620994110311210142881688876981774503",
"190148756675562889887515700666006732351",
"217486091757451679956403700471786834876",
"169879413884379341184353859978679368423",
"21648456997576052804352703915992674492",
"126008902910002815364916675629448699703",
"324238140497173308116358559029184806421",
"21985737292303801090159951087228385694",
"243472349916713243523195032704379237399",
"62700855463142360145376053520482616666",
"312882896047870446466505925888981342294",
"236038560222962776038777577013024831687",
"86965951805217094989309485356425974637",
"167020925418548721943700670118498243687",
"182453053255824443386670471774671529986",
"163796521000815467985856849434586161597",
"56550950249884089920462762358750411402",
"217577930934441446419732569268902453952",
"64970291896624684368145373263435702159",
"5138862212126175674731847901311289610"
]
},
"id": "CVE-2025-39744-31262e8b",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b41642c87716bbd09797b1e4ea7d904f06c39b7b",
"target": {
"file": "kernel/rcu/tree_plugin.h"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"53317365052084019700545308907320017459",
"179598365618244680663953403018185970121",
"212852304793197672854735272662084420419",
"204490644383161579968204985752748263750",
"274922945698605776140286847511868857975",
"198693885059848623485869535109539499039",
"317644354504155428780181597690844564630"
]
},
"id": "CVE-2025-39744-44f0a864",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1cfa244f7198d325594e627574930b7b91df5bfe",
"target": {
"file": "kernel/rcu/tree.h"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"function_hash": "233587338704570400306005963230547785475",
"length": 1930.0
},
"id": "CVE-2025-39744-510d6e4b",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b41642c87716bbd09797b1e4ea7d904f06c39b7b",
"target": {
"file": "kernel/rcu/tree_plugin.h",
"function": "rcu_preempt_deferred_qs_irqrestore"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"function_hash": "233587338704570400306005963230547785475",
"length": 1930.0
},
"id": "CVE-2025-39744-5168faf8",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ddebb2a7677673cf4438a04e1a48b8ed6b0c8e9a",
"target": {
"file": "kernel/rcu/tree_plugin.h",
"function": "rcu_preempt_deferred_qs_irqrestore"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"53317365052084019700545308907320017459",
"179598365618244680663953403018185970121",
"212852304793197672854735272662084420419",
"204490644383161579968204985752748263750",
"274922945698605776140286847511868857975",
"198693885059848623485869535109539499039",
"317644354504155428780181597690844564630"
]
},
"id": "CVE-2025-39744-7fd3eeeb",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b41642c87716bbd09797b1e4ea7d904f06c39b7b",
"target": {
"file": "kernel/rcu/tree.h"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"function_hash": "26487935627914245297794936605043601225",
"length": 206.0
},
"id": "CVE-2025-39744-8ec49810",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e7a375453cca2b8a0d2fa1b82b913f3fed7c0507",
"target": {
"file": "kernel/rcu/tree_plugin.h",
"function": "rcu_preempt_deferred_qs_handler"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"248127053304395159801114203277099886115",
"210620994110311210142881688876981774503",
"190148756675562889887515700666006732351",
"217486091757451679956403700471786834876",
"169879413884379341184353859978679368423",
"21648456997576052804352703915992674492",
"126008902910002815364916675629448699703",
"324238140497173308116358559029184806421",
"21985737292303801090159951087228385694",
"243472349916713243523195032704379237399",
"62700855463142360145376053520482616666",
"312882896047870446466505925888981342294",
"236038560222962776038777577013024831687",
"86965951805217094989309485356425974637",
"167020925418548721943700670118498243687",
"182453053255824443386670471774671529986",
"163796521000815467985856849434586161597",
"56550950249884089920462762358750411402",
"217577930934441446419732569268902453952",
"64970291896624684368145373263435702159",
"5138862212126175674731847901311289610"
]
},
"id": "CVE-2025-39744-a14aa5d9",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ddebb2a7677673cf4438a04e1a48b8ed6b0c8e9a",
"target": {
"file": "kernel/rcu/tree_plugin.h"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"53317365052084019700545308907320017459",
"179598365618244680663953403018185970121",
"212852304793197672854735272662084420419",
"204490644383161579968204985752748263750",
"274922945698605776140286847511868857975",
"198693885059848623485869535109539499039",
"317644354504155428780181597690844564630"
]
},
"id": "CVE-2025-39744-c0fd80bf",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e7a375453cca2b8a0d2fa1b82b913f3fed7c0507",
"target": {
"file": "kernel/rcu/tree.h"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"248127053304395159801114203277099886115",
"210620994110311210142881688876981774503",
"190148756675562889887515700666006732351",
"217486091757451679956403700471786834876",
"169879413884379341184353859978679368423",
"21648456997576052804352703915992674492",
"126008902910002815364916675629448699703",
"324238140497173308116358559029184806421",
"21985737292303801090159951087228385694",
"243472349916713243523195032704379237399",
"62700855463142360145376053520482616666",
"312882896047870446466505925888981342294",
"236038560222962776038777577013024831687",
"86965951805217094989309485356425974637",
"167020925418548721943700670118498243687",
"182453053255824443386670471774671529986",
"163796521000815467985856849434586161597",
"56550950249884089920462762358750411402",
"217577930934441446419732569268902453952",
"64970291896624684368145373263435702159",
"5138862212126175674731847901311289610"
]
},
"id": "CVE-2025-39744-cf8b931e",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1cfa244f7198d325594e627574930b7b91df5bfe",
"target": {
"file": "kernel/rcu/tree_plugin.h"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"function_hash": "190641189426445345805043707751860395716",
"length": 1293.0
},
"id": "CVE-2025-39744-d29cea15",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b41642c87716bbd09797b1e4ea7d904f06c39b7b",
"target": {
"file": "kernel/rcu/tree_plugin.h",
"function": "rcu_read_unlock_special"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"function_hash": "233587338704570400306005963230547785475",
"length": 1930.0
},
"id": "CVE-2025-39744-d6d6956b",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e7a375453cca2b8a0d2fa1b82b913f3fed7c0507",
"target": {
"file": "kernel/rcu/tree_plugin.h",
"function": "rcu_preempt_deferred_qs_irqrestore"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"function_hash": "190641189426445345805043707751860395716",
"length": 1293.0
},
"id": "CVE-2025-39744-e040dee3",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e7a375453cca2b8a0d2fa1b82b913f3fed7c0507",
"target": {
"file": "kernel/rcu/tree_plugin.h",
"function": "rcu_read_unlock_special"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"function_hash": "233587338704570400306005963230547785475",
"length": 1930.0
},
"id": "CVE-2025-39744-e2b8c219",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1cfa244f7198d325594e627574930b7b91df5bfe",
"target": {
"file": "kernel/rcu/tree_plugin.h",
"function": "rcu_preempt_deferred_qs_irqrestore"
}
}
]