CVE-2026-64248 Overview
CVE-2026-64248 is a Linux kernel flaw in the MIPS symmetric multiprocessing (SMP) shutdown path. The function smp_send_stop() parks secondary CPUs in stop_this_cpu() and marks them offline for the scheduler via set_cpu_online(false), but never notifies Read-Copy-Update (RCU). RCU continues to wait for a quiescent state from CPUs that spin forever with interrupts disabled. Any irq_work_sync() issued during reboot or shutdown then blocks on an RCU grace period that can never complete, hanging the system. The regression became visible after commit 91840be8f710 made irq_work_sync() call synchronize_rcu() on architectures without a self-IPI, which includes MIPS.
Critical Impact
Reboot and shutdown operations hang indefinitely on affected MIPS SMP systems, requiring hard power cycling.
Affected Products
- Linux kernel on MIPS SMP platforms (observed on MIPS interAptiv cores)
- Realtek MIPS switch System-on-Chips (SoCs) running affected kernels
- Stable branches back to 6.1, including 6.18.34 (surfaced during an OpenWrt kernel bump from 6.18.33 to 6.18.34)
Discovery Timeline
- 2026-07-24 - CVE-2026-64248 published to the National Vulnerability Database (NVD)
- 2026-07-30 - Last updated in NVD database
Technical Details for CVE-2026-64248
Vulnerability Analysis
The defect resides in the MIPS SMP shutdown routine. When smp_send_stop() executes, it directs secondary CPUs into stop_this_cpu(), which disables interrupts and enters an infinite loop. The routine flips scheduler state with set_cpu_online(false) but omits any RCU notification. RCU therefore continues to expect quiescent states from CPUs that will never respond.
The latent bug was benign until commit 91840be8f710 ("irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT") changed irq_work_sync() to call synchronize_rcu() on architectures where arch_irq_work_has_interrupt() returns false. MIPS uses the asm-generic default and returns false. Any irq_work_sync() invoked in the reboot path after smp_send_stop() now waits on a grace period that cannot advance, producing rcu_sched stall warnings and a hung reboot.
Root Cause
MIPS shuts down CPUs outside the standard CPU-hotplug offline path, so rcutree_report_cpu_dead() was never invoked for the parked cores. The kernel treats these CPUs as offline for scheduling purposes yet still online from RCU's perspective, creating a state mismatch that stalls grace periods.
Attack Vector
This issue is a local availability defect triggered by normal reboot or shutdown workflows on MIPS SMP hardware. There is no remote attacker interaction. Exploitation as a denial-of-service condition would require the ability to invoke irq_work_sync() after smp_send_stop() during system teardown, which occurs organically in the shutdown path.
The upstream fix calls rcutree_report_cpu_dead() once interrupts are disabled inside stop_this_cpu(), mirroring the generic CPU-hotplug offline path so RCU stops waiting on parked CPUs. This pattern is not without precedent: arm64 performs the same reporting in cpu_die_early().
Detection Methods for CVE-2026-64248
Indicators of Compromise
- Kernel log entries containing WARNING: CPU: 0 PID: 15 at kernel/irq_work.c:144 irq_work_queue_on during shutdown or reboot.
- rcu: INFO: rcu_sched detected stalls on CPUs/tasks messages that name offline CPUs as blocking the current grace period (for example, Offline CPU 1 blocking current GP).
- Reboot or shutdown -r operations on MIPS SMP devices that never complete and require a hard power cycle.
Detection Strategies
- Audit running MIPS kernels for the presence of commit 91840be8f710 without the corresponding fix commits (6eda719, 9f3f3bd, 9fef09d, e1919d0, f8a1ef8, f9b57a0).
- Collect serial console or dmesg output from MIPS SMP devices during controlled reboot tests and grep for rcu_sched detected stalls or irq_work_queue_on warnings.
- Track OpenWrt and vendor firmware builds derived from Linux 6.1 through 6.18 stable series that ship on MIPS interAptiv or similar cores.
Monitoring Recommendations
- Forward kernel logs from MIPS-based network devices to a centralized log store and alert on RCU stall signatures.
- Instrument reboot automation to timeout and flag any device that fails to complete a shutdown within an expected window.
- Include boot and reboot cycle testing in firmware validation pipelines for switches and embedded devices running affected kernels.
How to Mitigate CVE-2026-64248
Immediate Actions Required
- Apply the upstream Linux kernel fix that calls rcutree_report_cpu_dead() from stop_this_cpu() on MIPS.
- Rebuild and redeploy firmware for affected MIPS SMP devices, including Realtek switch SoCs and OpenWrt images based on Linux 6.1 through 6.18 stable branches.
- Verify reboot completion after patching by running scripted shutdown and boot cycles across the fleet.
Patch Information
The fix is available in the mainline and stable Linux trees. Reference commits: Linux Kernel Commit 6eda719, Linux Kernel Commit 9f3f3bd, Linux Kernel Commit 9fef09d, Linux Kernel Commit e1919d0, Linux Kernel Commit f8a1ef8, and Linux Kernel Commit f9b57a0.
Workarounds
- Revert to a kernel version prior to commit 91840be8f710 if the fix commits cannot be applied immediately, understanding that this reintroduces the original irq_work_single() use-after-free on PREEMPT_RT.
- Avoid callers of irq_work_sync() in the shutdown path on affected MIPS builds; this is not feasible in production and should only be used for lab reproduction.
- Schedule power-cycle procedures for affected devices until patched firmware is deployed, since graceful reboot cannot be relied upon.
# Verify running kernel version on an affected MIPS device
uname -r
# Inspect kernel ring buffer for RCU stall signatures after a failed reboot
dmesg | grep -E 'rcu_sched|irq_work_queue_on|Offline CPU'
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
