CVE-2025-39749

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

rcu: Protect ->defer_qs_iw_pending from data race

On kernels built with CONFIG_IRQ_WORK=y, when rcu_read_unlock() is

invoked within an interrupts-disabled region of code [1], it will invoke

rcu_read_unlock_special(), which uses an irq-work handler to force the

system to notice when the RCU read-side critical section actually ends.

That end won't happen until interrupts are enabled at the soonest.

In some kernels, such as those booted with rcutree.use_softirq=y, the

irq-work handler is used unconditionally.

The per-CPU rcu_data structure's ->defer_qs_iw_pending field is

updated by the irq-work handler and is both read and updated by

rcu_read_unlock_special(). This resulted in the following KCSAN splat:

------------------------------------------------------------------------

BUG: KCSAN: data-race in rcu_preempt_deferred_qs_handler / rcu_read_unlock_special

read to 0xffff96b95f42d8d8 of 1 bytes by task 90 on cpu 8

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References