Linux Kernel srcu Callback Invocation Issue on Non-Online CPUs

CVE-2026-64211

What is CVE-2026-64211?

In the Linux kernel, a vulnerability has been identified that affects the handling of srcu_struct structures during state transitions from CPU-0 to all-CPUs. Specifically, when transitioning, the kernel may erroneously queue callbacks for CPUs that have never been online or may never come online, including those not present in the cpu_possible_mask. This oversight can lead to system hangs on the s390 architecture, which is ill-equipped to manage workqueue handlers scheduled on such CPUs. The resolution involves modifying the Tree SRCU to prevent callbacks from being queued on these CPUs. Additionally, to mitigate improper invocations, the system now redirects callbacks intended for CPUs not fully online to the boot CPU, thus stabilizing the kernel's operation during such transitions.

References