CVE-2026-45957: rcu: Fix rcu_read_unlock() deadloop due to softirq
In the Linux kernel, the following vulnerability has been resolved:
rcu: Fix rcureadunlock() deadloop due to softirq
Commit 5f5fa7ea89dc ("rcu: Don't use negative nesting depth in rcureadunlock()") removes the recursion-protection code from rcureadunlock(). Therefore, we could invoke the deadloop in raisesoftirqirqoff() with ftrace enabled as follows:
WARNING: CPU: 0 PID: 0 at kernel/trace/trace.c:3021 ftracetracestack.constprop.0+0x172/0x180 Modules linked in: myirqwork(O) CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Tainted: G O 6.18.0-rc7-dirty #23 PREEMPT(full) Tainted: [O]=OOTMODULE Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 RIP: 0010:ftracetracestack.constprop.0+0x172/0x180 RSP: 0018:ffffc900000034a8 EFLAGS: 00010002 RAX: 0000000000000000 RBX: 0000000000000004 RCX: 0000000000000000 RDX: 0000000000000003 RSI: ffffffff826d7b87 RDI: ffffffff826e9329 RBP: 0000000000090009 R08: 0000000000000005 R09: ffffffff82afbc4c R10: 0000000000000008 R11: 0000000000011d7a R12: 0000000000000000 R13: ffff888003874100 R14: 0000000000000003 R15: ffff8880038c1054 FS: 0000000000000000(0000) GS:ffff8880fa8ea000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055b31fa7f540 CR3: 00000000078f4005 CR4: 0000000000770ef0 PKRU: 55555554 Call Trace: <IRQ> tracebufferunlockcommitregs+0x6d/0x220 traceeventbuffercommit+0x5c/0x260 traceeventraweventsoftirq+0x47/0x80 raisesoftirqirqoff+0x6e/0xa0 rcureadunlockspecial+0xb1/0x160 unwindnextframe+0x203/0x9b0 unwindstart+0x15d/0x1c0 archstackwalk+0x62/0xf0 stacktracesave+0x48/0x70 ftracetracestack.constprop.0+0x144/0x180 tracebufferunlockcommitregs+0x6d/0x220 traceeventbuffercommit+0x5c/0x260 traceeventraweventsoftirq+0x47/0x80 raisesoftirqirqoff+0x6e/0xa0 rcureadunlockspecial+0xb1/0x160 unwindnextframe+0x203/0x9b0 unwindstart+0x15d/0x1c0 archstackwalk+0x62/0xf0 stacktracesave+0x48/0x70 ftracetracestack.constprop.0+0x144/0x180 tracebufferunlockcommitregs+0x6d/0x220 traceeventbuffercommit+0x5c/0x260 traceeventraweventsoftirq+0x47/0x80 raisesoftirqirqoff+0x6e/0xa0 rcureadunlockspecial+0xb1/0x160 unwindnextframe+0x203/0x9b0 unwindstart+0x15d/0x1c0 archstackwalk+0x62/0xf0 stacktracesave+0x48/0x70 ftracetracestack.constprop.0+0x144/0x180 tracebufferunlockcommitregs+0x6d/0x220 traceeventbuffercommit+0x5c/0x260 traceeventraweventsoftirq+0x47/0x80 raisesoftirqirqoff+0x6e/0xa0 rcureadunlockspecial+0xb1/0x160 isinsnslotaddr+0x54/0x70 kerneltextaddress+0x48/0xc0 kerneltextaddress+0xd/0x40 unwindgetreturnaddress+0x1e/0x40 archstackwalk+0x9c/0xf0 stacktracesave+0x48/0x70 ftracetracestack.constprop.0+0x144/0x180 tracebufferunlockcommitregs+0x6d/0x220 traceeventbuffercommit+0x5c/0x260 traceeventraweventsoftirq+0x47/0x80 raisesoftirqirqoff+0x61/0x80 flushsmpcallfunctionqueue+0x115/0x420 sysveccallfunctionsingle+0x17/0xb0 sysveccallfunctionsingle+0x8c/0xc0 </IRQ>
Commit b41642c87716 ("rcu: Fix rcureadunlock() deadloop due to IRQ work") fixed the infinite loop in rcureadunlockspecial() for IRQ work by setting a flag before calling irqworkqueueon(). We fix this issue by setting the same flag before calling raisesoftirqirqoff() and rename the flag to deferqspending for more common.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.85-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.18.14-1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.128 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.75 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.14 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.19.4 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
ubuntu/linux-aws-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1060.63~22.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1063.71~22.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-fde-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1062.69~22.04.1 - Upgrade
Upgrade
ubuntu/linux-gcp-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1063.69~22.04.1 - Upgrade
Upgrade
ubuntu/linux-hwe-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-136.136~22.04.1 - Upgrade
Upgrade
ubuntu/linux-ibm-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1060.61~22.04.1 - Upgrade
Upgrade
ubuntu/linux-lowlatency-hwe-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-134.134.1~22.04.1 - Upgrade
Upgrade
ubuntu/linux-nvidia-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1058.61~22.04.1 - Upgrade
Upgrade
ubuntu/linux-oracle-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1057.58~22.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-134.134~22.04.1 - Upgrade
Upgrade
ubuntu/linux-realtime-6.8to a version that resolves this vulnerability.Fixed in 6.8.1-1055.56~22.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 6.8.0-134.134 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 6.8.0-1060.63 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 6.8.0-1063.71 - Upgrade
Upgrade
ubuntu/linux-azure-fdeto a version that resolves this vulnerability.Fixed in 6.8.0-1062.69 - Upgrade
Upgrade
ubuntu/linux-azure-nvidiato a version that resolves this vulnerability.Fixed in 6.8.0-1039.42 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 6.8.0-1063.69 - Upgrade
Upgrade
ubuntu/linux-gketo a version that resolves this vulnerability.Fixed in 6.8.0-1058.64 - Upgrade
Upgrade
ubuntu/linux-gkeopto a version that resolves this vulnerability.Fixed in 6.8.0-1045.48 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 6.8.0-1060.61 - Upgrade
Upgrade
ubuntu/linux-lowlatencyto a version that resolves this vulnerability.Fixed in 6.8.0-134.134.1 - Upgrade
Upgrade
ubuntu/linux-nvidiato a version that resolves this vulnerability.Fixed in 6.8.0-1058.61 - Upgrade
Upgrade
ubuntu/linux-nvidia-lowlatencyto a version that resolves this vulnerability.Fixed in 6.8.0-1058.61.1 - Upgrade
Upgrade
ubuntu/linux-nvidia-tegrato a version that resolves this vulnerability.Fixed in 6.8.0-1029.30 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 6.8.0-1057.58 - Upgrade
Upgrade
ubuntu/linux-raspito a version that resolves this vulnerability.Fixed in 6.8.0-1060.64 - Upgrade
Upgrade
ubuntu/linux-xilinxto a version that resolves this vulnerability.Fixed in 6.8.0-1032.33 - Upgrade
Upgrade
ubuntu/linux-bluefieldto a version that resolves this vulnerability.Fixed in 6.8.0-1026.30 - Upgrade
Upgrade
ubuntu/linux-raspi-realtimeto a version that resolves this vulnerability.Fixed in 6.8.0-2049.50 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 6.8.1-1055.56 - Upgrade
Upgrade
ubuntu/linux-aws-fipsto a version that resolves this vulnerability.Fixed in 6.8.0-1060.63+fips1 - Upgrade
Upgrade
ubuntu/linux-azure-fipsto a version that resolves this vulnerability.Fixed in 6.8.0-1062.69+fips1 - Upgrade
Upgrade
ubuntu/linux-fipsto a version that resolves this vulnerability.Fixed in 6.8.0-134.134+fips1 - Upgrade
Upgrade
ubuntu/linux-gcp-fipsto a version that resolves this vulnerability.Fixed in 6.8.0-1063.69+fips1
Event History
Frequently Asked Questions
What conditions are needed to trigger the issue?
The reported deadloop requires ftrace to be enabled and occurs through softirq handling in rcu_read_unlock(). The example also shows an out-of-tree module named my_irq_work, but the provided data does not establish that this specific module is required.
Who is most exposed?
Linux systems running kernels affected by the change that removed recursion protection from __rcu_read_unlock() are the relevant population, particularly systems using ftrace. Exploitation requires local privileges, as reflected by the AV:L and PR:L vector.
What is the likely impact?
The issue can cause rcu_read_unlock() to enter a deadloop, resulting in a denial of service. The supplied severity vector also indicates potential high confidentiality impact, but the description specifically demonstrates the deadloop condition.
How can administrators identify a possible occurrence?
Look for kernel warnings involving __ftrace_trace_stack.constprop.0 and trace.c:3021, especially alongside softirq activity and rcu_read_unlock() behavior. The example warning occurred on CPU 0 in the swapper/0 task with ftrace enabled.