CVE-2026-45957: Linux Kernel DOS Vulnerability

CVE-2026-45957 Overview

CVE-2026-45957 is a Linux kernel vulnerability in the Read-Copy-Update (RCU) subsystem. The flaw causes an infinite recursion (deadloop) in rcu_read_unlock_special() when invoked via raise_softirq_irqoff() with ftrace enabled. The issue was introduced by commit 5f5fa7ea89dc ("rcu: Don't use negative nesting depth in __rcu_read_unlock()"), which removed recursion-protection code from __rcu_read_unlock(). As a result, repeated entries into rcu_read_unlock_special() trigger nested softirq raises that recurse through the trace event path, exhausting the kernel stack and producing a system hang or warning.

Critical Impact
A local condition involving ftrace and RCU softirq deferral can drive the kernel into an infinite recursion, leading to denial of service on affected Linux kernels.

Affected Products

Linux kernel (mainline) prior to the fix commits referenced below
Linux kernel 6.18-rc series (reproduced on 6.18.0-rc7)
Stable Linux kernel branches containing commit 5f5fa7ea89dc without the corresponding fix

Discovery Timeline

2026-05-27 - CVE-2026-45957 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-45957

Vulnerability Analysis

The vulnerability resides in the RCU subsystem's deferred quiescent-state handling. After commit 5f5fa7ea89dc removed recursion-protection code from __rcu_read_unlock(), the function rcu_read_unlock_special() could be re-entered while servicing its own deferred work. When ftrace is enabled, calls to raise_softirq_irqoff() emit a softirq trace event. The trace event commit path performs a stack walk via stack_trace_save() and unwind_next_frame(), which themselves enter and exit RCU read-side critical sections.

Each exit calls back into rcu_read_unlock_special(), which again invokes raise_softirq_irqoff(), repeating the cycle. The provided kernel warning shows multiple stacked instances of rcu_read_unlock_special → raise_softirq_irqoff → trace_event_raw_event_softirq → __ftrace_trace_stack → stack_trace_save → unwind_next_frame → rcu_read_unlock_special, confirming the unbounded recursion. This [CWE-674]-class condition (uncontrolled recursion) renders the CPU unable to make forward progress.

Root Cause

The root cause is the absence of a guard preventing rcu_read_unlock_special() from re-entering its deferral paths while a deferred quiescent-state action is already pending. A prior fix, commit b41642c87716 ("rcu: Fix rcu_read_unlock() deadloop due to IRQ work"), addressed the same recursion for the irq_work_queue_on() path but did not cover raise_softirq_irqoff().

Attack Vector

Triggering the condition requires a kernel configuration with ftrace enabled and RCU preemption tracing active, plus workloads that cause rcu_read_unlock_special() to defer quiescent-state reporting through softirq. The condition is reproducible from kernel paths such as __flush_smp_call_function_queue() and sysvec_call_function_single(), and is not a remotely exploitable issue. The vulnerability manifests as a local denial of service rather than memory corruption or privilege escalation.

No verified public exploit code is available. See the kernel commit references for the precise patch hunks that introduce the defer_qs_pending guard.

Detection Methods for CVE-2026-45957

Indicators of Compromise

Kernel WARNING messages originating at kernel/trace/trace.c:3021 in __ftrace_trace_stack.constprop.0
Repeated stack frames showing rcu_read_unlock_special → raise_softirq_irqoff → trace_event_raw_event_softirq in dmesg output
Soft lockup or RCU stall warnings on systems with ftrace softirq events enabled

Detection Strategies

Monitor dmesg and /var/log/kern.log for stack traces containing recursive entries of rcu_read_unlock_special and raise_softirq_irqoff
Audit running kernel versions against the fix commits 1f16679a, 4a4a6e12, 979c708e, c2932e16, and d41e37f2
Identify hosts with the softirq tracepoint enabled (/sys/kernel/tracing/events/irq/softirq_raise/enable) running unpatched kernels

Monitoring Recommendations

Forward kernel logs to a central log analytics platform and alert on WARNING: CPU events tied to __ftrace_trace_stack
Track RCU stall and soft lockup counters exposed via /proc/sys/kernel and node exporters
Correlate kernel crash dumps with installed kernel package versions to confirm patch status across the fleet

How to Mitigate CVE-2026-45957

Immediate Actions Required

Inventory all Linux hosts running kernels that include commit 5f5fa7ea89dc but lack the defer_qs_pending fix
Apply vendor-supplied kernel updates that incorporate the upstream fix as soon as they are available
Disable ftrace softirq_raise tracing on production systems where patching is not yet possible

Patch Information

The upstream fix sets a defer_qs_pending flag before calling raise_softirq_irqoff() in rcu_read_unlock_special(), mirroring the prior IRQ-work fix from commit b41642c87716. The corrective patches are available in the following stable tree commits: Kernel Commit 1f16679, Kernel Commit 4a4a6e12, Kernel Commit 979c708e, Kernel Commit c2932e16, and Kernel Commit d41e37f2.

Workarounds

Disable the softirq tracepoint events on affected hosts until the kernel is patched
Avoid loading third-party kernel modules that exercise raise_softirq_irqoff() from RCU read-side critical sections
Restrict access to ftrace control interfaces under /sys/kernel/tracing to privileged operators only

bash

# Configuration example: disable the softirq tracepoints implicated in the deadloop
echo 0 | sudo tee /sys/kernel/tracing/events/irq/softirq_raise/enable
echo 0 | sudo tee /sys/kernel/tracing/events/irq/softirq_entry/enable
echo 0 | sudo tee /sys/kernel/tracing/events/irq/softirq_exit/enable

# Verify installed kernel version against fixed commits
uname -r