{"id":"CVE-2025-38704","revision":"2002fc23292c4de18a46ccab074d380c","records":[{"revision":"2002fc23292c4de18a46ccab074d380c","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2025-38704","aliases":[],"title":"rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer access","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nrcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer access\n\nIn the preparation stage of CPU online, if the corresponding\nthe rdp's->nocb_cb_kthread does not exist, will be created,\nthere is a situation where the rdp's rcuop kthreads creation fails,\nand then de-offload this CPU's rdp, does not assign this CPU's\nrdp->nocb_cb_kthread pointer, but this rdp's->nocb_gp_rdp and\nrdp's->rdp_gp->nocb_gp_kthread is still valid.\n\nThis will cause the subsequent re-offload operation of this offline\nCPU, which will pass the conditional check and the kthread_unpark()\nwill access invalid rdp's->nocb_cb_kthread pointer.\n\nThis commit therefore use rdp's->nocb_gp_kthread instead of\nrdp_gp's->nocb_gp_kthread for safety check.","state":0,"publishedAt":"2025-09-04T15:32:55.718+00:00","modifiedAt":"2026-10-15T01:07:42.799+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"kernel/rcu/tree_nocb.h\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"3a5761dc025da47960755ac64d9fbf1c32e8cd80\",\n                            \"lessThan\": \"b097ae798298885695c339d390b48b4e39619fa7\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"3a5761dc025da47960755ac64d9fbf1c32e8cd80\",\n                            \"lessThan\": \"3da45ec1e485a1a5ad31fe9ddd467c7ee5ae4ef9\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"3a5761dc025da47960755ac64d9fbf1c32e8cd80\",\n                            \"lessThan\": \"cce3d027227c69e85896af9fbc6fa9af5c68f067\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"3a5761dc025da47960755ac64d9fbf1c32e8cd80\",\n                            \"lessThan\": \"1c951683a720b17c9ecaad1932bc95b29044611f\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"3a5761dc025da47960755ac64d9fbf1c32e8cd80\",\n                            \"lessThan\": \"9b5ec8e6b31755288a07b3abeeab8cd38e9d3c9d\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"3a5761dc025da47960755ac64d9fbf1c32e8cd80\",\n                            \"lessThan\": \"1bba3900ca18bdae28d1b9fa10f16a8f8cb2ada1\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"kernel/rcu/tree_nocb.h\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6.0\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.0\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.167\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.130\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.43\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.15.11\",\n                            \"lessThanOrEqual\": \"6.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.16.2\",\n                            \"lessThanOrEqual\": \"6.16.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.17\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/b097ae798298885695c339d390b48b4e39619fa7","https://git.kernel.org/stable/c/3da45ec1e485a1a5ad31fe9ddd467c7ee5ae4ef9","https://git.kernel.org/stable/c/cce3d027227c69e85896af9fbc6fa9af5c68f067","https://git.kernel.org/stable/c/1c951683a720b17c9ecaad1932bc95b29044611f","https://git.kernel.org/stable/c/9b5ec8e6b31755288a07b3abeeab8cd38e9d3c9d","https://git.kernel.org/stable/c/1bba3900ca18bdae28d1b9fa10f16a8f8cb2ada1"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-38704","license":"CVE Program Terms of Use","key":"cve-program:CVE-2025-38704","identifiers":["CVE-2025-38704"]},"retained":false,"historicalAffected":[]}],"coverage":[]}