In the Linux kernel, the following vulnerability has been resolved:
rcu: Fix rcu_read_unlock() deadloop due to softirq
Commit 5f5fa7ea89dc ("rcu: Don't use negative nesting depth in __rcu_read_unlock()") removes the recursion-protection code from __rcu_read_unlock(). Therefore, we could invoke the deadloop in raise_softirq_irqoff() with ftrace enabled as follows:
WARNING: CPU: 0 PID: 0 at kernel/trace/trace.c:3021 __ftrace_trace_stack.constprop.0+0x172/0x180 Modules linked in: my_irq_work(O) CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Tainted: G O 6.18.0-rc7-dirty #23 PREEMPT(full) Tainted: [O]=OOT_MODULE Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 RIP: 0010:__ftrace_trace_stack.constprop.0+0x172/0x180 RSP: 0018:ffffc900000034a8 EFLAGS: 00010002 RAX: 0000000000000000 RBX: 0000000000000004 RCX: 0000000000000000 RDX: 0000000000000003 RSI: ffffffff826d7b87 RDI: ffffffff826e9329 RBP: 0000000000090009 R08: 0000000000000005 R09: ffffffff82afbc4c R10: 0000000000000008 R11: 0000000000011d7a R12: 0000000000000000 R13: ffff888003874100 R14: 0000000000000003 R15: ffff8880038c1054 FS: 0000000000000000(0000) GS:ffff8880fa8ea000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055b31fa7f540 CR3: 00000000078f4005 CR4: 0000000000770ef0 PKRU: 55555554 Call Trace: <IRQ> trace_buffer_unlock_commit_regs+0x6d/0x220 trace_event_buffer_commit+0x5c/0x260 trace_event_raw_event_softirq+0x47/0x80 raise_softirq_irqoff+0x6e/0xa0 rcu_read_unlock_special+0xb1/0x160 unwind_next_frame+0x203/0x9b0 __unwind_start+0x15d/0x1c0 arch_stack_walk+0x62/0xf0 stack_trace_save+0x48/0x70 __ftrace_trace_stack.constprop.0+0x144/0x180 trace_buffer_unlock_commit_regs+0x6d/0x220 trace_event_buffer_commit+0x5c/0x260 trace_event_raw_event_softirq+0x47/0x80 raise_softirq_irqoff+0x6e/0xa0 rcu_read_unlock_special+0xb1/0x160 unwind_next_frame+0x203/0x9b0 __unwind_start+0x15d/0x1c0 arch_stack_walk+0x62/0xf0 stack_trace_save+0x48/0x70 __ftrace_trace_stack.constprop.0+0x144/0x180 trace_buffer_unlock_commit_regs+0x6d/0x220 trace_event_buffer_commit+0x5c/0x260 trace_event_raw_event_softirq+0x47/0x80 raise_softirq_irqoff+0x6e/0xa0 rcu_read_unlock_special+0xb1/0x160 unwind_next_frame+0x203/0x9b0 __unwind_start+0x15d/0x1c0 arch_stack_walk+0x62/0xf0 stack_trace_save+0x48/0x70 __ftrace_trace_stack.constprop.0+0x144/0x180 trace_buffer_unlock_commit_regs+0x6d/0x220 trace_event_buffer_commit+0x5c/0x260 trace_event_raw_event_softirq+0x47/0x80 raise_softirq_irqoff+0x6e/0xa0 rcu_read_unlock_special+0xb1/0x160 __is_insn_slot_addr+0x54/0x70 kernel_text_address+0x48/0xc0 __kernel_text_address+0xd/0x40 unwind_get_return_address+0x1e/0x40 arch_stack_walk+0x9c/0xf0 stack_trace_save+0x48/0x70 __ftrace_trace_stack.constprop.0+0x144/0x180 trace_buffer_unlock_commit_regs+0x6d/0x220 trace_event_buffer_commit+0x5c/0x260 trace_event_raw_event_softirq+0x47/0x80 __raise_softirq_irqoff+0x61/0x80 __flush_smp_call_function_queue+0x115/0x420 __sysvec_call_function_single+0x17/0xb0 sysvec_call_function_single+0x8c/0xc0 </IRQ>
Commit b41642c87716 ("rcu: Fix rcu_read_unlock() deadloop due to IRQ work") fixed the infinite loop in rcu_read_unlock_special() for IRQ work by setting a flag before calling irq_work_queue_on(). We fix this issue by setting the same flag before calling raise_softirq_irqoff() and rename the flag to defer_qs_pending for more common.
CVSS Details
- CVSS 3.1 Base Score: 7.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 23, 2026 | Jul 23, 2026 |
| Ubuntu | — | Upgrade linux-image-nvidia-tegra-6.8Upgrade linux-image-6.8.0-134-lowlatency-64kUpgrade linux-image-nvidia-lowlatency-6.8Upgrade linux-image-6.8.0-134-genericUpgrade linux-image-gkeopUpgrade linux-image-intel-iot-realtimeUpgrade linux-image-generic-64kUpgrade linux-image-oem-22.04Upgrade linux-image-6.8.0-1057-oracleUpgrade linux-image-6.8.0-1058-nvidia-lowlatencyUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-6.8.0-1058-nvidia-64kUpgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-raspiUpgrade linux-image-oem-22.04aUpgrade linux-image-raspi-realtime-6.8Upgrade linux-image-6.8.0-1029-nvidia-tegraUpgrade linux-image-gcp-fips-6.8Upgrade linux-image-lowlatencyUpgrade linux-image-nvidia-tegra-rtUpgrade linux-image-aws-64kUpgrade linux-image-nvidia-64k-6.8Upgrade linux-image-nvidia-6.8Upgrade linux-image-virtualUpgrade linux-image-6.8.0-1060-raspiUpgrade linux-image-oracle-64k-lts-24.04Upgrade linux-image-6.8.0-134-generic-64kUpgrade linux-image-lowlatency-6.8Upgrade linux-image-6.8.0-1058-gke-64kUpgrade linux-image-6.8.0-1032-xilinxUpgrade linux-image-fipsUpgrade linux-image-gkeUpgrade linux-image-generic-lpaeUpgrade linux-image-azure-6.8Upgrade linux-image-azure-lts-24.04Upgrade linux-image-aws-6.8Upgrade linux-image-ibm-classicUpgrade linux-image-6.8.0-1063-gcp-64kUpgrade linux-image-lowlatency-64kUpgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-aws-fipsUpgrade linux-image-oracle-lts-24.04Upgrade linux-image-intel-iotgUpgrade linux-image-ibmUpgrade linux-image-nvidia-tegraUpgrade linux-image-oem-20.04bUpgrade linux-image-6.8.0-2049-raspi-realtimeUpgrade linux-image-genericUpgrade linux-image-oem-22.04cUpgrade linux-image-gkeop-6.8Upgrade linux-image-azureUpgrade linux-image-gcp-64k-lts-24.04Upgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-xilinx-zynqmpUpgrade linux-image-nvidiaUpgrade linux-image-oracle-64k-6.8Upgrade linux-image-6.8.0-1063-gcpUpgrade linux-image-gcp-fipsUpgrade linux-image-6.8.0-1060-awsUpgrade linux-image-azure-fde-6.8Upgrade linux-image-aws-fips-6.8Upgrade linux-image-6.8.0-1058-nvidiaUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-6.8.0-1060-ibmUpgrade linux-image-6.8.0-1058-nvidia-lowlatency-64kUpgrade linux-image-laptop-23.10Upgrade linux-image-6.8.0-1029-nvidia-tegra-rtUpgrade linux-image-awsUpgrade linux-image-6.8.0-1063-gcp-fipsUpgrade linux-image-6.8.0-1060-aws-fipsUpgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-6.8.0-1057-oracle-64kUpgrade linux-image-aws-lts-24.04Upgrade linux-image-oem-20.04Upgrade linux-image-nvidia-tegra-rt-6.8Upgrade linux-image-gke-64k-6.8Upgrade linux-image-oem-22.04dUpgrade linux-image-gcp-lts-24.04Upgrade linux-image-gcpUpgrade linux-image-raspi-realtimeUpgrade linux-image-generic-64k-6.8Upgrade linux-image-raspi-6.8Upgrade linux-image-ibm-lts-24.04Upgrade linux-image-nvidia-64kUpgrade linux-image-gke-6.8Upgrade linux-image-generic-hwe-22.04Upgrade linux-image-kvmUpgrade linux-image-ibm-6.8Upgrade linux-image-gcp-64k-6.8Upgrade linux-image-gcp-64kUpgrade linux-image-6.8.0-1045-gkeopUpgrade linux-image-generic-6.8Upgrade linux-image-fips-6.8Upgrade linux-image-azure-fipsUpgrade linux-image-aws-64k-lts-24.04Upgrade linux-image-aws-64k-6.8Upgrade linux-image-azure-fips-6.8Upgrade linux-image-azure-fdeUpgrade linux-image-6.8.0-1062-azure-fdeUpgrade linux-image-6.8.0-1058-gkeUpgrade linux-image-realtime-hwe-22.04Upgrade linux-image-virtual-hwe-22.04Upgrade linux-image-oem-20.04dUpgrade linux-image-6.8.0-1060-aws-64kUpgrade linux-image-oem-22.04bUpgrade linux-image-6.8.1-1055-realtimeUpgrade linux-image-oracleUpgrade linux-image-nvidia-lowlatency-64k-6.8Upgrade linux-image-lowlatency-64k-6.8Upgrade linux-image-gke-64kUpgrade linux-image-6.8.0-134-lowlatencyUpgrade linux-image-6.8.0-1063-azureUpgrade linux-image-oracle-64kUpgrade linux-image-xilinx-6.8Upgrade linux-image-6.8.0-134-fipsUpgrade linux-image-xilinxUpgrade linux-image-realtime-6.8.1Upgrade linux-image-realtimeUpgrade linux-image-oracle-6.8Upgrade linux-image-oem-20.04cUpgrade linux-image-gcp-6.8Upgrade linux-image-6.8.0-136-generic-64kUpgrade linux-image-6.8.0-136-genericUpgrade linux-image-virtual-6.8Upgrade linux-image-azure-fde-lts-24.04Upgrade linux-image-6.8.0-1062-azure-fips | Jul 2, 2026 | Jul 1, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub