CVE-2025-38704 Overview
CVE-2025-38704 is a Linux kernel vulnerability in the Read-Copy-Update No-Callback (RCU/NOCB) subsystem. The flaw involves invalid pointer access to rdp->nocb_cb_kthread during CPU online preparation. When rcuop kthread creation fails, the CPU's Read-Copy-Update Data Pointer (rdp) is de-offloaded without assigning the nocb_cb_kthread pointer, while related fields remain valid. A subsequent re-offload operation passes conditional checks and calls kthread_unpark() on the invalid pointer.
Critical Impact
A local, authenticated attacker able to trigger CPU hotplug operations may cause kernel memory corruption or denial of service through invalid pointer dereference.
Affected Products
- Linux Kernel (multiple stable branches, per upstream fix commits)
- Siemens products referenced in advisory SSA-019113
- Siemens products referenced in advisory SSA-082556
Discovery Timeline
- 2025-09-04 - CVE-2025-38704 published to the National Vulnerability Database (NVD)
- 2026-07-14 - Last updated in NVD database
Technical Details for CVE-2025-38704
Vulnerability Analysis
The vulnerability resides in the RCU/NOCB (No-Callback) subsystem of the Linux kernel, which offloads Read-Copy-Update callback processing to dedicated kernel threads (rcuop and rcuog). During CPU online preparation, the kernel attempts to create the per-CPU nocb_cb_kthread. If this creation fails, the CPU's rdp is de-offloaded, but the rdp->nocb_cb_kthread pointer remains unassigned.
The inconsistent state is dangerous because rdp->nocb_gp_rdp and rdp->rdp_gp->nocb_gp_kthread remain valid. When the system later re-offloads the CPU, existing conditional checks reference the still-valid grace-period fields and incorrectly conclude that the offload structures are ready. The subsequent kthread_unpark() call then dereferences the uninitialized nocb_cb_kthread pointer, resulting in undefined kernel behavior.
Root Cause
The root cause is inconsistent state cleanup on the kthread creation failure path. The safety check used rdp_gp->nocb_gp_kthread instead of rdp->nocb_gp_kthread, so per-CPU offload state was not properly validated. The upstream fix replaces the check to reference rdp->nocb_gp_kthread, ensuring the re-offload path validates the correct per-CPU pointer before proceeding.
Attack Vector
Exploitation requires local access with low privileges and no user interaction. An attacker must be able to influence CPU hotplug operations or induce conditions that cause rcuop kthread creation to fail, then trigger a re-offload of the affected CPU. Successful exploitation compromises kernel confidentiality, integrity, and availability.
No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. See the Kernel Commit cce3d027 for the authoritative patch describing the fix.
Detection Methods for CVE-2025-38704
Indicators of Compromise
- Kernel oops or general protection fault messages referencing kthread_unpark or nocb_cb_kthread in dmesg and /var/log/kern.log.
- Unexpected system panics or hangs correlated with CPU online/offline events via /sys/devices/system/cpu/cpu*/online.
- Failed rcuop/N or rcuog/N kthread creation entries in kernel logs during boot or hotplug.
Detection Strategies
- Inventory Linux hosts by kernel version and compare against the fixed commits in the vendor advisory URLs to identify vulnerable systems.
- Monitor auditd for processes issuing CPU hotplug operations (echo to /sys/devices/system/cpu/*/online) from non-root or unexpected contexts.
- Correlate kernel crash telemetry with recent hotplug activity to identify potential exploitation attempts.
Monitoring Recommendations
- Forward kernel logs and kdump crash artifacts to a centralized log platform for retention and analysis.
- Alert on repeated kthread creation failures containing the strings rcuop or nocb, which may indicate reconnaissance or exploitation attempts.
- Baseline normal CPU hotplug behavior on virtualized and container hosts to surface anomalous online/offline patterns.
How to Mitigate CVE-2025-38704
Immediate Actions Required
- Apply the upstream Linux kernel patches referenced in the vendor advisory URLs and reboot affected hosts.
- Update distribution kernels to versions that include the fix commits cce3d027, 9b5ec8e6, 1bba3900, and 1c951683.
- For Siemens products, follow guidance in Siemens Security Advisory SSA-019113 and Siemens Security Advisory SSA-082556.
Patch Information
The fix replaces the safety check in the RCU/NOCB re-offload path to use rdp->nocb_gp_kthread instead of rdp_gp->nocb_gp_kthread, preventing invalid access to the unassigned rdp->nocb_cb_kthread pointer. The authoritative fix is documented in Kernel Commit cce3d027, with stable backports at Kernel Commit 1bba3900, Kernel Commit 1c951683, and Kernel Commit 9b5ec8e6.
Workarounds
- Restrict access to CPU hotplug interfaces under /sys/devices/system/cpu/ to the root user and required management tooling only.
- Avoid dynamic CPU offlining and re-offloading on production kernels until the fix is applied.
- Reduce local attack surface by limiting shell access and containerized workloads with elevated capabilities such as CAP_SYS_ADMIN.
# Verify installed kernel and confirm patch inclusion
uname -r
rpm -q --changelog kernel | grep -i "nocb_cb_kthread\|cce3d027"
# Debian/Ubuntu
dpkg -l | grep linux-image
apt changelog linux-image-$(uname -r) | grep -i "nocb\|rcu"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
