UBUNTU-CVE-2026-45957: High severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: rcu: Fix rcureadunlock() deadloop due to softirq Commit 5f5fa7ea89dc ("rcu: Don't use negative nesting depth in rcureadunlock()") removes the recursion-protection code from rcureadunlock(). Therefore, we could invoke the deadloop in raisesoftirqirqoff() with ftrace enabled as follows: WARNING: CPU: 0 PID: 0 at kernel/trace/trace.c:3021 ftracetracestack.constprop.0+0x172/0x180 Modules linked in: myirqwork(O) CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Tainted: G O 6.18.0-rc7-dirty #23 PREEMPT(full) Tainted: [O]=OOTMODULE Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 RIP: 0010:ftracetracestack.constprop.0+0x172/0x180 RSP: 0018:ffffc900000034a8 EFLAGS: 00010002 RAX: 0000000000000000 RBX: 0000000000000004 RCX: 0000000000000000 RDX: 0000000000000003 RSI: ffffffff826d7b87 RDI: ffffffff826e9329 RBP: 0000000000090009 R08: 0000000000000005 R09: ffffffff82afbc4c R10: 0000000000000008 R11: 0000000000011d7a R12: 0000000000000000 R13: ffff888003874100 R14: 0000000000000003 R15: ffff8880038c1054 FS: 0000000000000000(0000) GS:ffff8880fa8ea000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055b31fa7f540 CR3: 00000000078f4005 CR4: 0000000000770ef0 PKRU: 55555554 Call Trace: <IRQ> tracebufferunlockcommitregs+0x6d/0x220 traceeventbuffercommit+0x5c/0x260 traceeventraweventsoftirq+0x47/0x80 raisesoftirqirqoff+0x6e/0xa0 rcureadunlockspecial+0xb1/0x160 unwindnextframe+0x203/0x9b0 unwindstart+0x15d/0x1c0 archstackwalk+0x62/0xf0 stacktracesave+0x48/0x70 ftracetracestack.constprop.0+0x144/0x180 tracebufferunlockcommitregs+0x6d/0x220 traceeventbuffercommit+0x5c/0x260 traceeventraweventsoftirq+0x47/0x80 raisesoftirqirqoff+0x6e/0xa0 rcureadunlockspecial+0xb1/0x160 unwindnextframe+0x203/0x9b0 unwindstart+0x15d/0x1c0 archstackwalk+0x62/0xf0 stacktracesave+0x48/0x70 ftracetracestack.constprop.0+0x144/0x180 tracebufferunlockcommitregs+0x6d/0x220 traceeventbuffercommit+0x5c/0x260 traceeventraweventsoftirq+0x47/0x80 raisesoftirqirqoff+0x6e/0xa0 rcureadunlockspecial+0xb1/0x160 unwindnextframe+0x203/0x9b0 unwindstart+0x15d/0x1c0 archstackwalk+0x62/0xf0 stacktracesave+0x48/0x70 ftracetracestack.constprop.0+0x144/0x180 tracebufferunlockcommitregs+0x6d/0x220 traceeventbuffercommit+0x5c/0x260 traceeventraweventsoftirq+0x47/0x80 raisesoftirqirqoff+0x6e/0xa0 rcureadunlockspecial+0xb1/0x160 isinsnslotaddr+0x54/0x70 kerneltextaddress+0x48/0xc0 kerneltextaddress+0xd/0x40 unwindgetreturnaddress+0x1e/0x40 archstackwalk+0x9c/0xf0 stacktracesave+0x48/0x70 ftracetracestack.constprop.0+0x144/0x180 tracebufferunlockcommitregs+0x6d/0x220 traceeventbuffercommit+0x5c/0x260 traceeventraweventsoftirq+0x47/0x80 raisesoftirqirqoff+0x61/0x80 flushsmpcallfunctionqueue+0x115/0x420 sysveccallfunctionsingle+0x17/0xb0 sysveccallfunctionsingle+0x8c/0xc0 </IRQ> Commit b41642c87716 ("rcu: Fix rcureadunlock() deadloop due to IRQ work") fixed the infinite loop in rcureadunlockspecial() for IRQ work by setting a flag before calling irqworkqueueon(). We fix this issue by setting the same flag before calling raisesoftirqirqoff() and rename the flag to deferqspending for more common.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-aws-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1060.63~22.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1063.71~22.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-fde-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1062.69~22.04.1 - Upgrade
Upgrade
ubuntu/linux-gcp-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1063.69~22.04.1 - Upgrade
Upgrade
ubuntu/linux-hwe-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-136.136~22.04.1 - Upgrade
Upgrade
ubuntu/linux-ibm-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1060.61~22.04.1 - Upgrade
Upgrade
ubuntu/linux-lowlatency-hwe-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-134.134.1~22.04.1 - Upgrade
Upgrade
ubuntu/linux-nvidia-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1058.61~22.04.1 - Upgrade
Upgrade
ubuntu/linux-oracle-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1057.58~22.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-134.134~22.04.1 - Upgrade
Upgrade
ubuntu/linux-realtime-6.8to a version that resolves this vulnerability.Fixed in 6.8.1-1055.56~22.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 6.8.0-134.134 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 6.8.0-1060.63 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 6.8.0-1063.71 - Upgrade
Upgrade
ubuntu/linux-azure-fdeto a version that resolves this vulnerability.Fixed in 6.8.0-1062.69 - Upgrade
Upgrade
ubuntu/linux-azure-nvidiato a version that resolves this vulnerability.Fixed in 6.8.0-1039.42 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 6.8.0-1063.69 - Upgrade
Upgrade
ubuntu/linux-gketo a version that resolves this vulnerability.Fixed in 6.8.0-1058.64 - Upgrade
Upgrade
ubuntu/linux-gkeopto a version that resolves this vulnerability.Fixed in 6.8.0-1045.48 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 6.8.0-1060.61 - Upgrade
Upgrade
ubuntu/linux-lowlatencyto a version that resolves this vulnerability.Fixed in 6.8.0-134.134.1 - Upgrade
Upgrade
ubuntu/linux-nvidiato a version that resolves this vulnerability.Fixed in 6.8.0-1058.61 - Upgrade
Upgrade
ubuntu/linux-nvidia-lowlatencyto a version that resolves this vulnerability.Fixed in 6.8.0-1058.61.1 - Upgrade
Upgrade
ubuntu/linux-nvidia-tegrato a version that resolves this vulnerability.Fixed in 6.8.0-1029.30 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 6.8.0-1057.58 - Upgrade
Upgrade
ubuntu/linux-raspito a version that resolves this vulnerability.Fixed in 6.8.0-1060.64 - Upgrade
Upgrade
ubuntu/linux-xilinxto a version that resolves this vulnerability.Fixed in 6.8.0-1032.33 - Upgrade
Upgrade
ubuntu/linux-bluefieldto a version that resolves this vulnerability.Fixed in 6.8.0-1026.30 - Upgrade
Upgrade
ubuntu/linux-raspi-realtimeto a version that resolves this vulnerability.Fixed in 6.8.0-2049.50 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 6.8.1-1055.56 - Upgrade
Upgrade
ubuntu/linux-aws-fipsto a version that resolves this vulnerability.Fixed in 6.8.0-1060.63+fips1 - Upgrade
Upgrade
ubuntu/linux-azure-fipsto a version that resolves this vulnerability.Fixed in 6.8.0-1062.69+fips1 - Upgrade
Upgrade
ubuntu/linux-fipsto a version that resolves this vulnerability.Fixed in 6.8.0-134.134+fips1 - Upgrade
Upgrade
ubuntu/linux-gcp-fipsto a version that resolves this vulnerability.Fixed in 6.8.0-1063.69+fips1
Event History
Frequently Asked Questions
What conditions are needed to trigger this issue?
The reported failure requires ftrace to be enabled and involves a softirq path. The supplied reproducer also shows an out-of-tree module, my_irq_work, loaded on a PREEMPT(full) kernel, but the data does not establish that this module or configuration is universally required.
What is the likely operational impact?
The issue can cause rcu_read_unlock() to enter a deadloop through raise_softirq_irqoff(), which can hang the affected CPU or system. The provided severity vector indicates high confidentiality impact and high availability impact, with no integrity impact.
Who can exploit this vulnerability?
The severity vector identifies local attack access and low privileges as required, with no user interaction. The supplied data does not describe a remote exploitation path.
Which Ubuntu kernel packages are listed as affected by this advisory?
The listed software includes ubuntu/linux, ubuntu/linux-realtime, ubuntu/linux-azure, ubuntu/linux-gcp, ubuntu/linux-azure-fde, ubuntu/linux-riscv, ubuntu/linux-gke, and ubuntu/linux-gkeop.