CVE-2025-38704

What it actually does

Use-after-free allowing invalid pointer dereference on rdp->nocb_cb_kthread during CPU re-offload after a failed rcuop kthread creation left the pointer unassigned while nocb_gp_rdp remained valid.

Why it matters to the business

Local attackers may crash Linux kernels or escalate privileges on servers and devices, causing downtime, data loss, or unauthorized access across any environment running the affected kernel versions.

How an attack unfolds

A local attacker triggers CPU online preparation where rcuop kthread creation fails, resulting in de-offload without assigning nocb_cb_kthread; subsequent re-offload passes the safety check and calls kthread_unpark on the dangling pointer.

How to fix it

Apply the upstream fix in commit cce3d027227c69e85896af9fbc6fa9af5c68f067 and update to the corresponding stable kernel releases that contain it.

How to confirm the fix worked

Confirm the running kernel source or binary contains commit cce3d027227c69e85896af9fbc6fa9af5c68f067; exercise CPU offline/online paths under load and verify no invalid pointer accesses occur.

Typical attack path

1. Obtain local unprivileged access on a Linux system
2. Force repeated CPU hotplug and offline sequences to induce rcuop kthread creation failure
3. Trigger re-offload of the affected CPU to dereference the freed nocb_cb_kthread pointer

How to detect it

Review kernel logs and dmesg for RCU nocb kthread warnings, use-after-free reports, or crashes during CPU hotplug events; correlate with audit logs showing repeated offline/online operations.

What your security team should do

• Prioritize kernel updates containing cce3d027227c69e85896af9fbc6fa9af5c68f067 on all Linux hosts
• Limit unprivileged local access and CPU hotplug permissions until patched
• Subscribe to distribution kernel advisories for backported fixes