CVE-2025-39745
NoneCVSS
—
EPSS
0.2%
Published
Sep 11, 2025
CISA due date
—
Cloudanix analysis
A Linux kernel testing tool produced false warnings on certain real-time setups and has been corrected so the tests run cleanly.
- Exploitation
- Other
- Attacker needs
- None
- Complexity
- Theoretical
- Impact
- Other
- Component
- OS kernel
- Class
- Other
- Remediation
- Upgrade
- Effort
- Low
- Patch risk
- None
What it actually does
rcutorture_one_extend_check incorrectly inspects preempt_count bits for BH disable on CONFIG_PREEMPT_RT kernels instead of using softirq_count, triggering a false WARNING during rcu_torture tests.
Why it matters to the business
Test suites on real-time Linux kernels produce spurious warnings that can mask real issues or trigger unnecessary investigation, with no effect on production workloads or data.
How an attack unfolds
No attacker exploitation path exists; the change resolves an internal test assertion mismatch and is not reachable from unprivileged user space or network input.
How to fix it
Apply the kernel patch containing commit a85550267247cdf5e7499be00ea8e388ab014e50 or upgrade to a release that includes it; rebuild and reinstall the kernel for affected RT configurations.
How to confirm the fix worked
Re-run rcutorture with CONFIG_PREEMPT_RT=y and confirm absence of the rcutorture_one_extend_check splat; inspect the updated source for use of softirq_count() in the check.
How to detect it
Search kernel logs for the exact splat string containing rcutorture_one_extend_check and preempt_count values; no production exploitation artifacts exist.
What your security team should do
- Treat as non-security test fix and schedule with normal kernel maintenance windows
- Verify RT kernel test environments are updated after the next stable merge window
- Monitor for similar preempt_count versus softirq_count mismatches in other RCU test code
The record
In the Linux kernel, the following vulnerability has been resolved: rcutorture: Fix rcutorture_one_extend_check() splat in RT kernels For built with CONFIG_PREEMPT_RT=y kernels, running rcutorture tests resulted in the following splat: [ 68.797425] rcutorture_one_extend_check during change: Current 0x1 To add 0x1 To remove 0x0 preempt_count() 0x0 [ 68.797533] WARNING: CPU: 2 PID: 512 at kernel/rcu/rcutorture.c:1993 rcutorture_one_extend_check+0x419/0x560 [rcutorture] [ 68.797601] Call Trace: [ 68.797602] <TASK> [ 68.797619] ? lockdep_softirqs_off+0xa5/0x160 [ 68.797631] rcutorture_one_extend+0x18e/0xcc0 [rcutorture 2466dbd2ff34dbaa36049cb323a80c3306ac997c] [ 68.797646] ? local_clock+0x19/0x40 [ 68.797659] rcu_torture_one_read+0xf0/0x280 [rcutorture 2466dbd2ff34dbaa36049cb323a80c3306ac997c] [ 68.797678] ? __pfx_rcu_torture_one_read+0x10/0x10 [rcutorture 2466dbd2ff34dbaa36049cb323a80c3306ac997c] [ 68.797804] ? __pfx_rcu_torture_timer+0x10/0x10 [rcutorture 2466dbd2ff34dbaa36049cb323a80c3306ac997c] [ 68.797815] rcu-torture: rcu_torture_reader task started [ 68.797824] rcu-torture: Creating rcu_torture_reader task [ 68.797824] rcu_torture_reader+0x238/0x580 [rcutorture 2466dbd2ff34dbaa36049cb323a80c3306ac997c] [ 68.797836] ? kvm_sched_clock_read+0x15/0x30 Disable BH does not change the SOFTIRQ corresponding bits in preempt_count() for RT kernels, this commit therefore use softirq_count() to check the if BH is disabled.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Chainguard | hyperv-daemons-6.12 | 0 | 6.12.60-r2 |
| Chainguard | linux-aws-6.12-boot-installed | 0 | 6.12.58-r0 |
| Chainguard | linux-aws-6.12-fips-boot-installed | 0 | 6.12.58-r0 |
| Chainguard | linux-aws-6.12-headers | 0 | 6.12.60-r1 |
| Chainguard | linux-aws-6.12-modules | 0 | 6.12.58-r0 |
| Chainguard | linux-azure-6.12-boot-installed | 0 | 6.12.60-r0 |
| Chainguard | linux-azure-6.12-fips-boot-installed | 0 | 6.12.60-r1 |
| Chainguard | linux-azure-6.12-headers | 0 | 6.12.60-r2 |
| Chainguard | linux-azure-6.12-modules | 0 | 6.12.58-r1 |
| Chainguard | linux-gcp-6.12-boot-installed | 0 | 6.12.58-r0 |
| Chainguard | linux-gcp-6.12-fips-boot-installed | 0 | 6.12.58-r0 |
| Chainguard | linux-gcp-6.12-headers | 0 | 6.12.58-r0 |
| Chainguard | linux-gcp-6.12-modules | 0 | 6.12.58-r0 |
| Chainguard | linux-qemu-6.12-boot-installed | 0 | 6.12.63-r0 |
| Chainguard | linux-qemu-6.12-fips-boot-installed | 0 | 6.12.63-r0 |
| Chainguard | linux-qemu-6.12-headers | 0 | 6.12.63-r0 |
| Chainguard | linux-qemu-6.12-modules | 0 | 6.12.63-r0 |
| Chainguard | linux-vmware-6.12 | 0 | 6.12.67-r0 |
| Chainguard | linux-vmware-6.12-boot-installed | 0 | 6.12.63-r0 |
| Chainguard | linux-vmware-6.12-fips-boot-installed | 0 | 6.12.63-r0 |
| Chainguard | linux-vmware-6.12-headers | 0 | 6.12.63-r0 |
| Chainguard | linux-vmware-6.12-modules | 0 | 6.12.63-r0 |
| Debian:11 | linux | 0 | No fix |
| Debian:12 | linux | 0 | No fix |
| Debian:13 | linux | 0 | No fix |
| Debian:14 | linux | 0 | 6.16.3-1 |
| Linux | Kernel | 0 | 6.15.11 |
| Linux | Kernel | 6.14.0 | 6.15.11 |
Related vulnerabilities
- CVE-2025-39910 In the Linux kernel, the following vulnerability has been resolved: mm/vmalloc, mm/kasan… Also affects hyperv-daemons-6.12
- CVE-2025-39925 can: j1939: implement NETDEV_UNREGISTER notification handler Also affects hyperv-daemons-6.12
- CVE-2025-39905 net: phylink: add lock for serializing concurrent pl->phydev writes with resolver Also affects hyperv-daemons-6.12
- CVE-2025-39862 In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915… Also affects hyperv-daemons-6.12
- CVE-2025-39859 In the Linux kernel, the following vulnerability has been resolved: ptp: ocp: fix… Also affects hyperv-daemons-6.12
- CVE-2025-39834 In the Linux kernel, the following vulnerability has been resolved: net/mlx5: HWS, Fix… Also affects hyperv-daemons-6.12
- CVE-2025-39830 In the Linux kernel, the following vulnerability has been resolved: net/mlx5: HWS, Fix… Also affects hyperv-daemons-6.12
- CVE-2025-39833 In the Linux kernel, the following vulnerability has been resolved: mISDN: hfcpci: Fix… Also affects hyperv-daemons-6.12