PT-2026-2512 · Linux+2 · Linux Kernel+2
Published
2025-08-14
·
Updated
2026-06-16
·
CVE-2025-68780
CVSS v2.0
4.6
Medium
| Vector | AV:L/AC:L/Au:S/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
The Linux kernel contains a flaw within the scheduler/deadline component. A correction ensures that the
free cpus bit is only set for online runqueues. A previous commit introduced functions to manipulate the cpu dl::free cpus mask, and a subsequent commit removed a check of the cpu active mask. This resulted in a scenario where the free cpus bit could be incorrectly set for a CPU when the deadline runqueue is offline, potentially leading to tasks being scheduled on powered-down CPUs. The issue arises when a CPU transitions through the default root domain or when the last deadline task is migrated from a CPU with an offlined runqueue. The correction modifies the cpudl clear function to consider the online state of the deadline runqueue, ensuring appropriate updates to the free cpus mask. The cpudl set/clear freecpu functions have been removed, and the code now utilizes non-atomic cpumask functions due to the mask being updated under the cpudl lock.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
Improper Locking
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Linuxmint
Linux Kernel
Ubuntu