Executive brief
A vulnerability in the Linux kernel's core synchronization mechanism (RCU) can cause a system to enter an infinite loop, leading to a complete system hang or crash. This occurs when specific diagnostic tracing tools (ftrace) are active, triggering a recursive software interrupt cycle. While this primarily impacts system availability, it requires high-level system access to trigger.
Technical details
The vulnerability is a deadloop (infinite recursion) in the RCU (Read-Copy Update) subsystem, specifically within the `rcu_read_unlock_special()` function. It was introduced by a previous change that removed recursion protection from `__rcu_read_unlock()`. When `ftrace` is enabled, calling `raise_softirq_irqoff()` can trigger a stack trace, which in turn calls RCU functions, leading to an infinite loop of software interrupts. The fix involves implementing a `defer_qs_pending` flag to prevent re-entrant calls to the softirq handler during RCU processing. The issue is reachable locally by a privileged user or through specific kernel configurations that trigger frequent softirqs while tracing is active.
Affected products
- Linux Linux Kernel 6.18-rc7 and earlier versions
Timeline
- 2026-01-01: patched: Initial patch authored by Yao Kai
- 2026-05-27: disclosed: CVE published to NVD
References
- https://git.kernel.org/stable/c/1f16679a5aa60238466ce339c35f5e82ece60337
- https://git.kernel.org/stable/c/4a4a6e12c9c829be3f74b7206fa8640fc4e1c566
- https://git.kernel.org/stable/c/979c708e6c9d7fc461daef2dad8b45f22e23464c
- https://git.kernel.org/stable/c/c2932e16d8c354404b17123e64daa8e33191e145
- https://git.kernel.org/stable/c/d41e37f26b3157b3f1d10223863519a943aa239b