Linux Kernel LoongArch RCU CPU Offlining Bug
CVE-2026-64250 Published on July 24, 2026
LoongArch: Report dying CPU to RCU in stop_this_cpu()
In the Linux kernel, the following vulnerability has been resolved:
LoongArch: Report dying CPU to RCU in stop_this_cpu()
This is a port of MIPS commit 9f3f3bdc6d9dac1 ("MIPS: smp: report dying
CPU to RCU in stop_this_cpu()"). smp_send_stop() parks all secondary
CPUs in stop_this_cpu(). And the function marks the CPU offline for the
scheduler via set_cpu_online(false) but never informs RCU, so RCU keeps
expecting a quiescent state from CPUs that are now spinning forever with
interrupts disabled.
As long as nothing waits for an RCU grace period after smp_send_stop()
this is harmless, which is why it went unnoticed. However, since commit
91840be8f710370 ("irq_work: Fix use-after-free in irq_work_single() on
PREEMPT_RT"), irq_work_sync() calls synchronize_rcu() on architectures
without an irq_work self-IPI, i.e. where arch_irq_work_has_interrupt()
returns false. Any irq_work_sync() issued in the reboot/shutdown/halt
path after smp_send_stop() then blocks on a grace period that can never
complete, hanging the reboot:
WARNING: CPU: 0 PID: 15 at kernel/irq_work.c:144 irq_work_queue_on
...
rcu: INFO: rcu_sched detected stalls on CPUs/tasks:
rcu: Offline CPU 1 blocking current GP.
rcu: Offline CPU 2 blocking current GP.
rcu: Offline CPU 3 blocking current GP.
This issue needs some hacks to reproduce, and it was not noticed on
LoongArch because arch_irq_work_has_interrupt() usually returns true.
Call rcutree_report_cpu_dead() once interrupts are disabled, mirroring
the generic CPU-hotplug offline path, so RCU stops waiting on the parked
CPUs and grace periods can still complete. LoongArch shuts down all CPUs
here without going through the CPU-hotplug mechanism, so this report is
not otherwise issued.
Products Associated with CVE-2026-64250
Want to know whenever a new CVE is published for Linux Kernel? stack.watch will email you.
Affected Versions
Linux:- Version 2dc79362302922cb18f35e262712b5e58de65442 and below 262dadc619e69ebeb97affd334cd1078a9704e98 is affected.
- Version eef4f71b46a9929ac33e968538c9dd5d96a02460 and below 1fa22de588a65880d6fe54c38c87fffe7d519f60 is affected.
- Version 684a78183c54c23e70d1cba320f7fc184604210b and below a0269e928728f970c782319fee53d92d4ea4e512 is affected.
- Version 18c0456ea2615b1a743a6db739c74411c3b42bc6 and below 90e254f18b8c224460082329dd5c42fd30995c2f is affected.
- Version 91840be8f710370607f949a627e070896faeddb8 and below 0833b2b84c2fc1387f8165f0cbf6a02d67f647a5 is affected.
- Version 91840be8f710370607f949a627e070896faeddb8 and below f2539c56c74691e7a88af6372ba2b48c06ed2fe4 is affected.
- Version 81b582784518196eff1050212a046bc29d3a05dd is affected.
- Version 6.1.175 and below 6.1.178 is affected.
- Version 6.6.142 and below 6.6.145 is affected.
- Version 6.12.92 and below 6.12.95 is affected.
- Version 6.18.34 and below 6.18.38 is affected.
- Version 7.0.11 and below 7.1 is affected.
- Version 7.1 is affected.
- Before 7.1 is unaffected.
- Version 6.1.178, <= 6.1.* is unaffected.
- Version 6.6.145, <= 6.6.* is unaffected.
- Version 6.12.95, <= 6.12.* is unaffected.
- Version 6.18.38, <= 6.18.* is unaffected.
- Version 7.1.3, <= 7.1.* is unaffected.
- Version 7.2-rc1, <= * is unaffected.