SB20260727330 - Improper Initialization in Linux kernel loongarch kernel

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20260727330

SB20260727330 - Improper Initialization in Linux kernel loongarch kernel

Published: July 27, 2026

Security Bulletin ID SB20260727330
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Local access
Highest impact Denial of service

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Improper Initialization (CVE-ID: CVE-2026-64250)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in stop_this_cpu() when handling reboot, shutdown, or halt paths after secondary CPUs are parked. A local user can trigger a reboot or shutdown sequence to cause a denial of service.

The issue occurs on LoongArch systems because parked CPUs are marked offline for the scheduler but are not reported dead to RCU, which can cause an RCU grace period to wait indefinitely. It affects cases where irq_work_sync() invokes synchronize_rcu() on architectures without an irq_work self-IPI.


Remediation

Install update from vendor's website.

References