CVE-2026-64250: LoongArch: Report dying CPU to RCU in stop_this_cpu()

Published Jul 24, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

LoongArch: Report dying CPU to RCU in stopthiscpu()

This is a port of MIPS commit 9f3f3bdc6d9dac1 ("MIPS: smp: report dying CPU to RCU in stopthiscpu()"). smpsendstop() parks all secondary CPUs in stopthiscpu(). And the function marks the CPU offline for the scheduler via setcpuonline(false) but never informs RCU, so RCU keeps expecting a quiescent state from CPUs that are now spinning forever with interrupts disabled.

As long as nothing waits for an RCU grace period after smpsendstop() this is harmless, which is why it went unnoticed. However, since commit 91840be8f710370 ("irqwork: Fix use-after-free in irqworksingle() on PREEMPTRT"), irqworksync() calls synchronizercu() on architectures without an irqwork self-IPI, i.e. where archirqworkhasinterrupt() returns false. Any irqworksync() issued in the reboot/shutdown/halt path after smpsendstop() then blocks on a grace period that can never complete, hanging the reboot:

WARNING: CPU: 0 PID: 15 at kernel/irqwork.c:144 irqworkqueueon ... rcu: INFO: rcusched detected stalls on CPUs/tasks: rcu: Offline CPU 1 blocking current GP. rcu: Offline CPU 2 blocking current GP. rcu: Offline CPU 3 blocking current GP.

This issue needs some hacks to reproduce, and it was not noticed on LoongArch because archirqworkhasinterrupt() usually returns true.

Call rcutreereportcpudead() once interrupts are disabled, mirroring the generic CPU-hotplug offline path, so RCU stops waiting on the parked CPUs and grace periods can still complete. LoongArch shuts down all CPUs here without going through the CPU-hotplug mechanism, so this report is not otherwise issued.

Affected Software

13 affected componentsFixes available
Linux Kernel
Microsoft azl3 kernel 6.6.144.1-1<6.6.145.2-1
6.6.145.2-1
Linux Linux kernel>=6.1.175<6.1.178
Linux Linux kernel>=6.6.142<6.6.145
Linux Linux kernel>=6.12.92<6.12.95
Linux Linux kernel>=6.18.34<6.18.38
Linux Linux kernel>=7.0.11<7.1
Linux Linux kernel>=7.1.1<7.1.3
Linux Linux kernel=7.1
Linux Linux kernel=7.1-rc4
Linux Linux kernel=7.1-rc5
Linux Linux kernel=7.1-rc6
Linux Linux kernel=7.1-rc7

Event History

Jul 24, 2026
CVE Published
via MITRE·03:31 PM
Data Sourced
via MITRE·03:31 PM
Description
Data Sourced
via NVD·04:16 PM
RemedyDescriptionSeverityAffected Software
Jul 26, 2026
Data Sourced
via Microsoft·08:02 AM
DescriptionSeverityWeakness
Data Sourced
via Microsoft·08:02 AM
Affected Software
Updated
via Microsoft·08:02 AM
DescriptionSeverity

Frequently Asked Questions

1

What is the severity of CVE-2026-64250?

The severity of CVE-2026-64250 is rated as medium with a score of 5.5.

2

How do I fix CVE-2026-64250?

To fix CVE-2026-64250, update your Linux kernel to the latest version that includes the patch for this vulnerability.

3

What systems are affected by CVE-2026-64250?

CVE-2026-64250 affects systems running the Linux kernel and Microsoft azl3 kernel 6.6.144.1-1.

4

What type of vulnerability is CVE-2026-64250?

CVE-2026-64250 is categorized as a Use After Free vulnerability.

5

What is the impact of CVE-2026-64250?

The impact of CVE-2026-64250 can lead to denial of service due to the vulnerability in the handling of dying CPUs.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203