Critical Vulnerability in Linux Kernel: RCU/NOCB Pointer Access Issue
Summary
CVE-2025-38704: In the Linux kernel, the following vulnerability has been resolved: rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer access In the preparation stage of CPU online, if the corresponding the rdp's->nocb_cb_kth... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interaction. It is known for its robustness and versatility, supporting a wide range of devices and applications. However, like any complex software, it is susceptible to vulnerabilities that can compromise system integrity and security. This specific vulnerability affects multiple Debian versions, highlighting the importance of timely updates and patches.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the RCU/NOCB subsystem, where an invalid pointer access can occur during CPU online preparation. If the corresponding rdp's->nocb_cb_kthread does not exist, it may lead to a situation where the rdp's rcuop kthreads creation fails. Consequently, if this CPU's rdp is de-offloaded without assigning the rdp->nocb_cb_kthread pointer, it can result in accessing an invalid pointer during subsequent operations, potentially leading to system instability or crashes.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is recommended to apply the patches as soon as they are available to mitigate the risk.
Conclusion
The CVE-2025-38704 vulnerability in the Linux kernel poses a significant risk due to potential invalid pointer access. It is essential for users of affected Debian versions to update their packages to the patched versions to mitigate this risk. Regular monitoring and timely updates are crucial for maintaining system security.
See every vulnerability recorded for linux →
FAQ
CVE-2025-38704 is a vulnerability in the Linux kernel related to invalid pointer access in the RCU/NOCB subsystem.
Debian 11, 12, 13, and 14 are affected, with specific patched versions available for Debian 13 and 14.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Exploiting this vulnerability could lead to system instability or crashes due to invalid pointer access.
It is recommended to regularly check for updates and apply them promptly to ensure your system remains secure.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
