High 7.8Published Sep 4, 2025

CVE-2025-38704rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer access

Updated under an hour ago (Oct 27, 2026, 7:00 AM ET)

Does this affect you?

It affects Linux and 5 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer access In the preparation stage of CPU online, if the corresponding the rdp's->nocb_cb_kthread does not exist, will be created, there is a situation where the rdp's rcuop kthreads creation fails, and then de-offload this CPU's rdp, does not assign this CPU's rdp->nocb_cb_kthread pointer, but this rdp's->nocb_gp_rdp and rdp's->rdp_gp->nocb_gp_kthread is still valid. This will cause the subsequent re-offload operation of this offline CPU, which will pass the conditional check and the kthread_unpark() will access invalid rdp's->nocb_cb_kthread pointer. This commit therefore use rdp's->nocb_gp_kthread instead of rdp_gp's->nocb_gp_kthread for safety check.

CVSS: 7.8 HIGH (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 14, 2026
First seen by InfoSec Signals: Oct 14, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 3a5761dc025da47960755ac64d9fbf1c32e8cd80 before b097ae798298885695c339d390b48b4e39619fa7; from 3a5761dc025da47960755ac64d9fbf1c32e8cd80 before 3da45ec1e485a1a5ad31fe9ddd467c7ee5ae4ef9; from 3a5761dc025da47960755ac64d9fbf1c32e8cd80 before cce3d027227c69e85896af9fbc6fa9af5c68f067; 3a5761dc025da47960755ac64d9fbf1c32e8cd80 builds before 1c951683a720b17c9ecaad1932bc95b29044611f; from 3a5761dc025da47960755ac64d9fbf1c32e8cd80 before 9b5ec8e6b31755288a07b3abeeab8cd38e9d3c9d; 3a5761dc025da47960755ac64d9fbf1c32e8cd80 builds before 1bba3900ca18bdae28d1b9fa10f16a8f8cb2ada1	CNA record
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518f_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem siemens:simatic_s7_1500_tm_mfp_gnu_linux_subsystem (from the name)	all versions	CISA ADP
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP siemens:siplus_s7_1500_cpu_1518_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP
linux linux_kernel linux:linux_kernel	before 6.12.43; from 6.13 before 6.15.11; from 6.16 before 6.16.2	NVD

References

References

https://git.kernel.org/stable/c/b097ae798298885695c339d390b48b4e39619fa7
https://git.kernel.org/stable/c/3da45ec1e485a1a5ad31fe9ddd467c7ee5ae4ef9
https://git.kernel.org/stable/c/cce3d027227c69e85896af9fbc6fa9af5c68f067	patch
https://git.kernel.org/stable/c/1c951683a720b17c9ecaad1932bc95b29044611f	patch
https://git.kernel.org/stable/c/9b5ec8e6b31755288a07b3abeeab8cd38e9d3c9d	patch
https://git.kernel.org/stable/c/1bba3900ca18bdae28d1b9fa10f16a8f8cb2ada1	patch
https://cert-portal.siemens.com/productcert/html/ssa-019113.html
https://cert-portal.siemens.com/productcert/html/ssa-082556.html
https://cert-portal.siemens.com/productcert/html/ssa-457936.html
https://cert-portal.siemens.com/productcert/html/ssa-784472.html

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.