PT-2026-64365 · Linux · Linux
CVE-2026-64250
·
Publicado
2026-07-24
·
Atualizado
2026-07-24
Nenhuma
Não há classificações de severidade ou métricas disponíveis. Quando houver, atualizaremos as informações correspondentes na página.
In the Linux kernel, the following vulnerability has been resolved:
LoongArch: Report dying CPU to RCU in stop this cpu()
This is a port of MIPS commit 9f3f3bdc6d9dac1 ("MIPS: smp: report dying
CPU to RCU in stop this cpu()"). smp send stop() parks all secondary
CPUs in stop this cpu(). And the function marks the CPU offline for the
scheduler via set cpu online(false) but never informs RCU, so RCU keeps
expecting a quiescent state from CPUs that are now spinning forever with
interrupts disabled.
As long as nothing waits for an RCU grace period after smp send stop()
this is harmless, which is why it went unnoticed. However, since commit
91840be8f710370 ("irq work: Fix use-after-free in irq work single() on
PREEMPT RT"), irq work sync() calls synchronize rcu() on architectures
without an irq work self-IPI, i.e. where arch irq work has interrupt()
returns false. Any irq work sync() issued in the reboot/shutdown/halt
path after smp send stop() then blocks on a grace period that can never
complete, hanging the reboot:
WARNING: CPU: 0 PID: 15 at kernel/irq work.c:144 irq work queue on
...
rcu: INFO: rcu sched detected stalls on CPUs/tasks:
rcu: Offline CPU 1 blocking current GP.
rcu: Offline CPU 2 blocking current GP.
rcu: Offline CPU 3 blocking current GP.
This issue needs some hacks to reproduce, and it was not noticed on
LoongArch because arch irq work has interrupt() usually returns true.
Call rcutree report cpu dead() once interrupts are disabled, mirroring
the generic CPU-hotplug offline path, so RCU stops waiting on the parked
CPUs and grace periods can still complete. LoongArch shuts down all CPUs
here without going through the CPU-hotplug mechanism, so this report is
not otherwise issued.
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Linux