Improper Initialization in Linux kernel - CVE-2026-64250
Published: July 27, 2026
Vulnerability identifier: #VU139741
CSH Severity: Low
CVSS v4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-64250
CWE-ID: CWE-665
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper state management in stop_this_cpu() when handling reboot, shutdown, or halt paths after secondary CPUs are parked. A local user can trigger a reboot or shutdown sequence to cause a denial of service.
The issue occurs on LoongArch systems because parked CPUs are marked offline for the scheduler but are not reported dead to RCU, which can cause an RCU grace period to wait indefinitely. It affects cases where irq_work_sync() invokes synchronize_rcu() on architectures without an irq_work self-IPI.
Affected software
Linux kernel
How to mitigate CVE-2026-64250
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3
External References
- https://git.kernel.org/stable/c/0833b2b84c2fc1387f8165f0cbf6a02d67f647a5
- https://git.kernel.org/stable/c/1fa22de588a65880d6fe54c38c87fffe7d519f60
- https://git.kernel.org/stable/c/262dadc619e69ebeb97affd334cd1078a9704e98
- https://git.kernel.org/stable/c/90e254f18b8c224460082329dd5c42fd30995c2f
- https://git.kernel.org/stable/c/a0269e928728f970c782319fee53d92d4ea4e512
- https://git.kernel.org/stable/c/f2539c56c74691e7a88af6372ba2b48c06ed2fe4