CVE-2025-40163: sched/deadline: Stop dl_server before CPU goes offline

Published Nov 12, 2025

Updated

In the Linux kernel, the following vulnerability has been resolved:

sched/deadline: Stop dlserver before CPU goes offline

IBM CI tool reported kernel warning[1] when running a CPU removal operation through drmgr[2]. i.e "drmgr -c cpu -r -q 1"

WARNING: CPU: 0 PID: 0 at kernel/sched/cpudeadline.c:219 cpudlset+0x58/0x170 NIP [c0000000002b6ed8] cpudlset+0x58/0x170 LR [c0000000002b7cb8] dlservertimer+0x168/0x2a0 Call Trace: [c000000002c2f8c0] initstack+0x78c0/0x8000 (unreliable) [c0000000002b7cb8] dlservertimer+0x168/0x2a0 [c00000000034df84] hrtimerrunqueues+0x1a4/0x390 [c00000000034f624] hrtimerinterrupt+0x124/0x300 [c00000000002a230] timerinterrupt+0x140/0x320

Git bisects to: commit 4ae8d9aa9f9d ("sched/deadline: Fix dlserver getting stuck")

This happens since: - dlserver hrtimer gets enqueued close to cpu offline, when kthreadpark enqueues a fair task. - CPU goes offline and drmgr removes it from cpupresentmask. - hrtimer fires and warning is hit.

Fix it by stopping the dlserver before CPU is marked dead.

[1]: https://lore.kernel.org/all/8218e149-7718-4432-9312-f97297c352b9@linux.ibm.com/ [2]: https://github.com/ibm-power-utilities/powerpc-utils/tree/next/src/drmgr

[sshegde: wrote the changelog and tested it]

Affected Software

1 affected component

Linux Linux kernel

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Linux kernel to a version that resolves this vulnerability.
Patch 4ae8d9aa9f9d

Event History

Nov 12, 2025

CVE Published

via MITRE·10:26 AM

Data Sourced

via MITRE·10:26 AM

Description

Data Sourced

via NVD·11:15 AM

Description

Frequently Asked Questions

What is the severity of CVE-2025-40163?

The severity of CVE-2025-40163 is categorized as moderate due to the potential CPU removal operation warning that may impact system stability.

How do I fix CVE-2025-40163?

To fix CVE-2025-40163, update the Linux kernel to the latest stable version where the vulnerability has been resolved.

What systems are affected by CVE-2025-40163?

CVE-2025-40163 affects various versions of the Linux kernel that implement the deadline scheduling feature.

Is CVE-2025-40163 easily exploitable?

CVE-2025-40163 is not easily exploitable as it requires specific conditions related to CPU removal operations to trigger the warning.

Are there any workarounds for CVE-2025-40163?

There are no specific workarounds for CVE-2025-40163; the best practice is to apply the recommended kernel updates.