Executive brief
A vulnerability in the Linux kernel for MIPS-based systems can cause devices to hang or fail to respond during a reboot or shutdown process. This occurs because the system's internal task coordinator (RCU) waits indefinitely for processor cores that have already been powered down. While this primarily affects system availability during maintenance or restart cycles, it can lead to operational delays or require manual power cycles to recover.
Technical details
A race condition or logic error exists in the MIPS SMP implementation where 'stop_this_cpu()' marks a CPU as offline for the scheduler but fails to inform the RCU subsystem. On MIPS architectures lacking a self-IPI for IRQ work, 'irq_work_sync()' calls 'synchronize_rcu()', which then blocks indefinitely waiting for a quiescent state from the already-parked CPUs. This results in RCU stalls and a kernel hang during the shutdown/reboot path. The fix involves explicitly calling 'rcutree_report_cpu_dead()' within 'stop_this_cpu()' after interrupts are disabled.
Affected products
- Linux Linux Kernel 6.1 to 6.18.34
Timeline
- 2026-06-08: other: Patch authored
- 2026-07-04: patched: Patch committed to stable branches
- 2026-07-24: disclosed: CVE published
References
- https://git.kernel.org/stable/c/6eda71977ee11c222f8ad4cae4d18d50448e56f4
- https://git.kernel.org/stable/c/9f3f3bdc6d9dac1a5a8262ee7ad0f2ff1527a7e7
- https://git.kernel.org/stable/c/9fef09df42df55ab819b285ea892e0fc1b95a9c4
- https://git.kernel.org/stable/c/e1919d026706544cb6e7251ec06e908edd6f34ee
- https://git.kernel.org/stable/c/f8a1ef884013dc99f712d3eb75624c7cd3fd94f6
- https://git.kernel.org/stable/c/f9b57a0015c241274651f4b36627f56b1b5a8651