Critical Vulnerability in Linux Kernel: RCU Torture Test Issue
Summary
CVE-2025-39745: In the Linux kernel, the following vulnerability has been resolved: rcutorture: Fix rcutorture_one_extend_check() splat in RT kernels For built with CONFIG_PREEMPT_RT=y kernels, running rcutorture tests resulted in the f... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interactions. It is known for its robustness, flexibility, and extensive support for various hardware architectures. However, it is not immune to vulnerabilities. This specific issue affects the kernel's real-time (RT) configuration, particularly during the execution of rcutorture tests, which are designed to validate the kernel's RCU (Read-Copy-Update) mechanism.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the rcutorture testing framework, specifically in the function rcutorture_one_extend_check(). This issue arises when the kernel is built with CONFIG_PREEMPT_RT enabled, leading to a warning message during the execution of rcutorture tests. The warning indicates a potential inconsistency in the preempt_count() value, which could lead to unexpected behavior in real-time systems. If left unaddressed, this vulnerability may compromise system stability and reliability, particularly in environments where real-time performance is critical.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. However, users are advised to avoid running rcutorture tests on RT kernels until the patch is applied.
Conclusion
The vulnerability identified in the Linux kernel's rcutorture testing framework poses a significant risk to systems configured for real-time performance. Users are encouraged to update their kernels to the patched version to mitigate potential issues. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for linux →
FAQ
The rcutorture test is a framework used to validate the RCU (Read-Copy-Update) mechanism in the Linux kernel, ensuring that it operates correctly under various conditions.
CONFIG_PREEMPT_RT is a kernel configuration option that enables real-time capabilities in the Linux kernel, allowing for more predictable scheduling and lower latency in task execution.
Failing to address this vulnerability may lead to system instability, unexpected behavior, and potential crashes in environments that rely on real-time performance.
You can use Vulert, a tool that monitors and alerts for open-source vulnerabilities in your software. By simply uploading your manifest file, you can check if your application is affected by this vulnerability.
Detailed information about this vulnerability can be found in the CVE database and through security advisories released by the Linux kernel maintainers.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
