Description
In the Linux kernel, the following vulnerability has been resolved:
LoongArch: Report dying CPU to RCU in stop_this_cpu()
This is a port of MIPS commit 9f3f3bdc6d9dac1 ("MIPS: smp: report dying
CPU to RCU in stop_this_cpu()"). smp_send_stop() parks all secondary
CPUs in stop_this_cpu(). And the function marks the CPU offline for the
scheduler via set_cpu_online(false) but never informs RCU, so RCU keeps
expecting a quiescent state from CPUs that are now spinning forever with
interrupts disabled.
As long as nothing waits for an RCU grace period after smp_send_stop()
this is harmless, which is why it went unnoticed. However, since commit
91840be8f710370 ("irq_work: Fix use-after-free in irq_work_single() on
PREEMPT_RT"), irq_work_sync() calls synchronize_rcu() on architectures
without an irq_work self-IPI, i.e. where arch_irq_work_has_interrupt()
returns false. Any irq_work_sync() issued in the reboot/shutdown/halt
path after smp_send_stop() then blocks on a grace period that can never
complete, hanging the reboot:
WARNING: CPU: 0 PID: 15 at kernel/irq_work.c:144 irq_work_queue_on
...
rcu: INFO: rcu_sched detected stalls on CPUs/tasks:
rcu: Offline CPU 1 blocking current GP.
rcu: Offline CPU 2 blocking current GP.
rcu: Offline CPU 3 blocking current GP.
This issue needs some hacks to reproduce, and it was not noticed on
LoongArch because arch_irq_work_has_interrupt() usually returns true.
Call rcutree_report_cpu_dead() once interrupts are disabled, mirroring
the generic CPU-hotplug offline path, so RCU stops waiting on the parked
CPUs and grace periods can still complete. LoongArch shuts down all CPUs
here without going through the CPU-hotplug mechanism, so this report is
not otherwise issued.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Linux | Linux | 6.1.175 – < 6.1.178, 6.6.142 – < 6.6.145, 6.12.92 – < 6.12.95, 6.18.34 – < 6.18.38, 7.0.11 – < 7.1, 7.1 | 6.1.178 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | linux | 7.1.3-1 | — |
| Debian 13 | linux | 6.12.95-1 | — |
| Debian 12 | linux | 6.1.180-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 24.04 LTS | linux-riscv +20 | No fix yet | — |
| Ubuntu 22.04 LTS | linux-riscv +32 | No fix yet | — |
| Ubuntu 20.04 LTS | linux-gke +28 | No fix yet | — |
| Ubuntu 18.04 LTS | linux-gcp +14 | No fix yet | — |
| Ubuntu 16.04 LTS | linux-hwe-edge | No fix yet | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro Realtime 24.04 LTS | linux-realtime-6.14 | No fix yet | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | kernel-source | 7.1.7-1.1 | openSUSE-SU-2026:11476-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | kernel-livepatch-6.18.38-73.137 +1 | 1:1.0-0.amzn2023 | ALAS2023-2026-2014, ALAS2023-2026-1969 |
| Amazon Linux 2023 | perf6.12 +11 | 1:6.12.95-124.187.amzn2023 | ALAS2023-2026-2014 |
| Amazon Linux 2023 | perf6.18 +12 | 1:6.18.38-73.137.amzn2023 | ALAS2023-2026-1969 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | kernel | 6.6.145.2-1 | — |
Advisories 4
- WID-SEC-2026-2527 Linux Kernel: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 12, 2026
- ALAS2023-2026-2014 Important: kernel6.12 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Aug 12, 2026
- ALAS2023-2026-1969 Important: kernel6.18 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Aug 10, 2026
- openSUSE-SU-2026:11476-1 kernel-devel-7.1.7-1.1 on GA media SUSE / openSUSE Security Updates · Aug 10, 2026
References
- https://git.kernel.org/stable/c/262dadc619e69ebeb97affd334cd1078a9704e98
- https://git.kernel.org/stable/c/1fa22de588a65880d6fe54c38c87fffe7d519f60
- https://git.kernel.org/stable/c/a0269e928728f970c782319fee53d92d4ea4e512
- https://git.kernel.org/stable/c/90e254f18b8c224460082329dd5c42fd30995c2f
- https://git.kernel.org/stable/c/0833b2b84c2fc1387f8165f0cbf6a02d67f647a5
- https://git.kernel.org/stable/c/f2539c56c74691e7a88af6372ba2b48c06ed2fe4