{"id":"CVE-2025-39744","summary":"rcu: Fix rcu_read_unlock() deadloop due to IRQ work","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nrcu: Fix rcu_read_unlock() deadloop due to IRQ work\n\nDuring rcu_read_unlock_special(), if this happens during irq_exit(), we\ncan lockup if an IPI is issued. This is because the IPI itself triggers\nthe irq_exit() path causing a recursive lock up.\n\nThis is precisely what Xiongfeng found when invoking a BPF program on\nthe trace_tick_stop() tracepoint As shown in the trace below. Fix by\nmanaging the irq_work state correctly.\n\nirq_exit()\n  __irq_exit_rcu()\n    /* in_hardirq() returns false after this */\n    preempt_count_sub(HARDIRQ_OFFSET)\n    tick_irq_exit()\n      tick_nohz_irq_exit()\n\t    tick_nohz_stop_sched_tick()\n\t      trace_tick_stop()  /* a bpf prog is hooked on this trace point */\n\t\t   __bpf_trace_tick_stop()\n\t\t      bpf_trace_run2()\n\t\t\t    rcu_read_unlock_special()\n                              /* will send a IPI to itself */\n\t\t\t      irq_work_queue_on(&rdp-\u003edefer_qs_iw, rdp-\u003ecpu);\n\nA simple reproducer can also be obtained by doing the following in\ntick_irq_exit(). It will hang on boot without the patch:\n\n  static inline void tick_irq_exit(void)\n  {\n +\trcu_read_lock();\n +\tWRITE_ONCE(current-\u003ercu_read_unlock_special.b.need_qs, true);\n +\trcu_read_unlock();\n +\n\n[neeraj: Apply Frederic's suggested fix for PREEMPT_RT]","modified":"2026-04-02T12:48:08.844430Z","published":"2025-09-11T16:52:17.725Z","related":["SUSE-SU-2025:03600-1","SUSE-SU-2025:03601-1","SUSE-SU-2025:03633-1","SUSE-SU-2025:03634-1","SUSE-SU-2025:20851-1","SUSE-SU-2025:20861-1","SUSE-SU-2025:20870-1","SUSE-SU-2025:20898-1","SUSE-SU-2025:21074-1","SUSE-SU-2025:21139-1","SUSE-SU-2025:21179-1","SUSE-SU-2025:3725-1","SUSE-SU-2025:3751-1","openSUSE-SU-2025:20081-1"],"database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/39xxx/CVE-2025-39744.json"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/1cfa244f7198d325594e627574930b7b91df5bfe"},{"type":"WEB","url":"https://git.kernel.org/stable/c/56c5ef194f4509df63fc0f7a91ea5973ce479b1e"},{"type":"WEB","url":"https://git.kernel.org/stable/c/b41642c87716bbd09797b1e4ea7d904f06c39b7b"},{"type":"WEB","url":"https://git.kernel.org/stable/c/ddebb2a7677673cf4438a04e1a48b8ed6b0c8e9a"},{"type":"WEB","url":"https://git.kernel.org/stable/c/e7a375453cca2b8a0d2fa1b82b913f3fed7c0507"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/39xxx/CVE-2025-39744.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-39744"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"0864f057b050bc6dd68106b3185e02db5140012d"},{"fixed":"e7a375453cca2b8a0d2fa1b82b913f3fed7c0507"},{"fixed":"1cfa244f7198d325594e627574930b7b91df5bfe"},{"fixed":"ddebb2a7677673cf4438a04e1a48b8ed6b0c8e9a"},{"fixed":"56c5ef194f4509df63fc0f7a91ea5973ce479b1e"},{"fixed":"b41642c87716bbd09797b1e4ea7d904f06c39b7b"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-39744.json"}}],"schema_version":"1.7.5"}