CVE-2025-39742

What it actually does

Division by zero in find_hw_thread_mask() when num_core_siblings is zero because the zero check occurs after the division of online CPU count by num_core_siblings.

Why it matters to the business

Local denial of service via kernel panic on systems using the hfi1 RDMA driver under specific CPU topology conditions; low urgency given absence from known exploited lists and minimal exploitation probability.

How an attack unfolds

An attacker with local access on a vulnerable Linux kernel triggers find_hw_thread_mask() with a CPU configuration where num_core_siblings evaluates to zero, causing an immediate divide-by-zero fault and kernel crash; listed threat actors focus on container privilege escalation paths but this issue is not tied to active campaigns.

How to fix it

Update the Linux kernel to the fixed commit 9bba1a9994c523b44db64f63b564b4719ea2b7ef in the stable repository; rebuild and deploy the patched kernel image on affected systems.

How to confirm the fix worked

Verify the running kernel contains commit 9bba1a9994c523b44db64f63b564b4719ea2b7ef via git log or version string; attempt to exercise the function under zero-sibling conditions in a test environment and confirm absence of divide-by-zero fault.

Typical attack path

1. Obtain local user access on target Linux system
2. Trigger hfi1 RDMA code path that invokes find_hw_thread_mask()
3. Ensure or induce a CPU topology where num_core_siblings is zero
4. Cause division operation to execute before the zero guard
5. Trigger kernel panic and denial of service

How to detect it

Search kernel logs and dmesg for divide-by-zero faults or oops messages originating from find_hw_thread_mask in the hfi1 RDMA module; review system crash dumps for CPU topology values at the time of the fault.

• divide error: 0000 [#1] SMP
• RIP: find_hw_thread_mask
• hfi1: divide by zero in find_hw_thread_mask

What your security team should do

• Prioritize patching systems that expose the hfi1 driver and have variable CPU sibling counts
• Apply the fixed commit during the next kernel update cycle
• Monitor for kernel oops reports referencing find_hw_thread_mask until patches are deployed