CVE-2025-38704 rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer access
A null pointer dereference in the Linux kernel RCU subsystem can cause a system crash during CPU online operations.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-38704?
CVE-2025-38704 is a high-severity vulnerability in Linux kernel, published on 4 Sep 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer access
In the preparation stage of CPU online, if the corresponding the rdp's->nocb_cb_kthread does not exist, will be created, there is a situation where the rdp's rcuop kthreads creation fails, and then de-offload this CPU's rdp, does not assign this CPU's rdp->nocb_cb_kthread pointer, but this rdp's->nocb_gp_rdp and rdp's->rdp_gp->nocb_gp_kthread is still valid.
This will cause the subsequent re-offload operation of this offline CPU, which will pass the conditional check and the kthread_unpark() will access invalid rdp's->nocb_cb_kthread pointer.
This commit therefore use rdp's->nocb_gp_kthread instead of rdp_gp's->nocb_gp_kthread for safety check.
Which versions are affected by CVE-2025-38704?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2025-38704?
Apply the vendor's patch.
Is CVE-2025-38704 being exploited?
There is no known exploitation of CVE-2025-38704 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-66893, AZL-70754, BELL-CVE-2025-38704, DEBIAN-CVE-2025-38704, GHSA-8f3q-p7pf-m5wj, ROOT-OS-DEBIAN-11-CVE-2025-38704 and 4 more.