CVE-2025-39744: Linux Kernel Race Condition Vulnerability

CVE-2025-39744 Overview

CVE-2025-39744 is a Linux kernel vulnerability in the Read-Copy-Update (RCU) subsystem. The flaw causes a recursive deadlock inside rcu_read_unlock_special() when invoked during irq_exit(). If the function issues an Inter-Processor Interrupt (IPI) to itself, the IPI re-enters the irq_exit() path and creates an infinite loop. Researcher Xiongfeng identified the issue while running a Berkeley Packet Filter (BPF) program hooked on the trace_tick_stop() tracepoint. Local users with the ability to load or trigger BPF programs on affected tracepoints can trigger a full system hang. The Linux kernel maintainers resolved the issue by managing the irq_work state correctly.

Critical Impact
A local, low-privileged user can trigger a full kernel deadlock leading to complete denial of service on affected Linux systems.

Affected Products

Linux Kernel (multiple stable branches prior to the fix commits)
Distributions shipping vulnerable kernel builds with CONFIG_PREEMPT_RCU enabled
Systems allowing BPF programs to attach to the trace_tick_stop() tracepoint

Discovery Timeline

2025-09-11 - CVE-2025-39744 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-39744

Vulnerability Analysis

The vulnerability resides in the RCU subsystem of the Linux kernel, specifically in rcu_read_unlock_special(). This function completes RCU quiescent-state reporting when an RCU read-side critical section ends under special conditions such as preemption or a pending quiescent-state request.

When rcu_read_unlock_special() executes during irq_exit(), the kernel has already decremented the hardirq preempt count. in_hardirq() therefore returns false. The RCU code then attempts to defer the quiescent-state report by queueing IRQ work with irq_work_queue_on(&rdp->defer_qs_iw, rdp->cpu), which sends a self-IPI. Handling that IPI re-enters irq_exit(), which re-enters rcu_read_unlock_special(), which queues another IPI. The system deadloops.

The issue is classified as CWE-125 (Out-of-Bounds Read) in the CVE record, though the practical manifestation is a recursive lockup and denial of service.

Root Cause

The root cause is missing state tracking for the deferred quiescent-state IRQ work. The RCU code did not check whether defer_qs_iw was already pending or executing before queueing another instance, allowing repeated re-entry through the irq_exit() path.

Attack Vector

Exploitation requires local access. An unprivileged user who can attach a BPF program to trace_tick_stop(), or otherwise cause rcu_read_unlock_special() to run during irq_exit() with need_qs set, can trigger the deadloop. The commit description provides a minimal reproducer that inserts rcu_read_lock(), sets current->rcu_read_unlock_special.b.need_qs, and calls rcu_read_unlock() inside tick_irq_exit(). Systems boot-hang immediately without the patch.

Detection Methods for CVE-2025-39744

Indicators of Compromise

Kernel soft-lockup or hard-lockup warnings referencing rcu_read_unlock_special, irq_work_queue_on, or tick_nohz_irq_exit in dmesg or /var/log/messages
Unresponsive CPUs pegged at 100% in kernel context with no forward progress
System hangs during boot after loading BPF programs attached to timer or tick tracepoints

Detection Strategies

Inventory running kernel versions across the fleet and compare against the fixed commit hashes (1cfa244f, 56c5ef19, b41642c8, ddebb2a7, e7a37545).
Monitor kernel ring buffer telemetry for repeated RCU-related stack traces indicating recursive irq_exit() entry.
Audit which unprivileged users or containers have CAP_BPF or CAP_SYS_ADMIN and can attach programs to kernel tracepoints.

Monitoring Recommendations

Forward dmesg and /proc/kmsg output to a centralized logging pipeline and alert on rcu_sched self-detected stall or soft lockup messages.
Track BPF program load events via audit rules on the bpf() syscall to identify unusual tracepoint attachments.
Alert on unexpected host reboots or availability drops that correlate with BPF activity.

How to Mitigate CVE-2025-39744

Immediate Actions Required

Upgrade affected systems to a Linux kernel build that includes the RCU fix commits listed in the vendor advisories.
Restrict BPF program loading to trusted administrators by setting kernel.unprivileged_bpf_disabled=1.
Prioritize patching multi-tenant hosts, container platforms, and systems that expose BPF or tracing to unprivileged workloads.

Patch Information

The Linux kernel maintainers merged the fix across multiple stable branches. Review the upstream commits: Kernel Patch Commit 1cfa244, Kernel Patch Commit 56c5ef1, Kernel Patch Commit b41642c, Kernel Patch Commit ddebb2a, and Kernel Patch Commit e7a3754. Apply the vendor-supplied kernel package that includes these commits.

Workarounds

Disable unprivileged BPF: sysctl -w kernel.unprivileged_bpf_disabled=1.
Remove or restrict CAP_BPF and CAP_PERFMON from untrusted user namespaces and container runtimes.
Avoid attaching BPF programs to timer-tick tracepoints such as trace_tick_stop() until patched kernels are deployed.

bash

# Configuration example: disable unprivileged BPF and persist across reboots
sudo sysctl -w kernel.unprivileged_bpf_disabled=1
echo 'kernel.unprivileged_bpf_disabled=1' | sudo tee /etc/sysctl.d/99-cve-2025-39744.conf
sudo sysctl --system