Junglewise Threat Intelligence

CVE-2025-38704: Linux Kernel invalid pointer access in RCU NOCB offload

CVE-2025-38704 · Severity: high · CVSS 7.8 · Published 2025-09-04

Technologies: Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP, Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP, Linux Kernel, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP. Vendors: Siemens, Linux.

Executive brief

A vulnerability was identified in the Linux kernel's Read-Copy Update (RCU) mechanism, which manages how the system handles data updates across multiple processors. Under specific conditions involving CPU power management or reconfiguration, the system may attempt to access an invalid memory pointer, leading to a kernel crash or system instability. This could allow a local user to disrupt system operations or potentially gain unauthorized control over the affected device. The issue also impacts certain Siemens industrial controllers that utilize the affected kernel versions.

Technical details

The vulnerability exists in the RCU NOCB (no-callback) subsystem of the Linux kernel, specifically within the `rcu_nocb_rdp_offload` function in `kernel/rcu/tree_nocb.h`. During CPU online preparation, if the creation of RCU offload kthreads (`rcuop`) fails and the CPU is subsequently de-offloaded, the `rdp->nocb_cb_kthread` pointer may remain unassigned or invalid while other related pointers remain valid. A subsequent re-offload operation can bypass safety checks and trigger `kthread_unpark()` on the invalid pointer. The fix involves updating the safety check to use `rdp->nocb_gp_kthread` instead of the potentially inconsistent `rdp_gp->nocb_gp_kthread`. This is a local vulnerability requiring the ability to trigger CPU hotplug or RCU offload events.

Affected products

  • Linux Linux Kernel versions prior to 6.1.x, 6.6.x, 6.10.x, 6.11.x
  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5, V3.1.6
  • Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.5, V3.1.6
  • Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.5, V3.1.6

Timeline

  • 2025-09-04: advisory: Initial NVD publication date
  • 2025-05-07: patched: Original patch authored by Zqiang

References

Related threats