CVE-2025-38704: Linux Kernel invalid pointer access in RCU NOCB offload

CVE-2025-38704 · Severity: high · CVSS 7.8 · Published 2025-09-04

A vulnerability was identified in the Linux kernel's Read-Copy Update (RCU) mechanism, which manages how the system handles data updates across multiple processors. Under specific conditions involving CPU power management or reconfiguration, the system may attempt to access an invalid memory pointer, leading to a kernel crash or system instability. This could allow a local user to disrupt system operations or potentially gain unauthorized control over the affected device. The issue also impacts certain Siemens industrial controllers that utilize the affected kernel versions.

Technologies: Linux Kernel, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP, Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP, Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP. Vendors: Linux, Siemens.

Quick answers

Is CVE-2025-38704 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-38704 being exploited in the wild.
How severe is CVE-2025-38704?
High severity, with a CVSS score of 7.8, published 4 September 2025.
Which products and versions are affected?
Linux Kernel versions prior to 6.1.x, 6.6.x, 6.10.x, 6.11.x; Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5, V3.1.6; Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.5, V3.1.6; Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.5, V3.1.6.
Is there a fix for CVE-2025-38704?
A patch was published on 2025-05-07: Original patch authored by Zqiang Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-38704 attacked?
It is attacked with local access, in an operating system.
Am I affected by CVE-2025-38704?
Check whether you run Linux Kernel, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP, Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the RCU NOCB (no-callback) subsystem of the Linux kernel, specifically within the `rcu_nocb_rdp_offload` function in `kernel/rcu/tree_nocb.h`. During CPU online preparation, if the creation of RCU offload kthreads (`rcuop`) fails and the CPU is subsequently de-offloaded, the `rdp->nocb_cb_kthread` pointer may remain unassigned or invalid while other related pointers remain valid. A subsequent re-offload operation can bypass safety checks and trigger `kthread_unpark()` on the invalid pointer. The fix involves updating the safety check to use `rdp->nocb_gp_kthread` instead of the potentially inconsistent `rdp_gp->nocb_gp_kthread`. This is a local vulnerability requiring the ability to trigger CPU hotplug or RCU offload events.

Affected products

  • Linux Linux Kernel versions prior to 6.1.x, 6.6.x, 6.10.x, 6.11.x
  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5, V3.1.6
  • Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.5, V3.1.6
  • Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.5, V3.1.6

Timeline

  • 2025-09-04: advisory: Initial NVD publication date
  • 2025-05-07: patched: Original patch authored by Zqiang

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.