CVE-2025-68780

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

sched/deadline: only set free_cpus for online runqueues

Commit 16b269436b72 ("sched/deadline: Modify cpudl::free_cpus

to reflect rd->online") introduced the cpudl_set/clear_freecpu

functions to allow the cpu_dl::free_cpus mask to be manipulated

by the deadline scheduler class rq_on/offline callbacks so the

mask would also reflect this state.

Commit 9659e1eeee28 ("sched/deadline: Remove cpu_active_mask

from cpudl_find()") removed the check of the cpu_active_mask to

save some processing on the premise that the cpudl::free_cpus

mask already reflected the runqueue online state.

Unfortunately, there are cases where it is possible for the

cpudl_clear function to set the free_cpus bit for a CPU when the

deadline runqueue is offline. When this occurs while a CPU is

connected to the default root domain the flag may retain the bad

state after the CPU has been unplugged. Later, a different CPU

that is transitioning through th

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References