{
  "threat_severity" : "Moderate",
  "public_date" : "2025-07-04T00:00:00Z",
  "bugzilla" : {
    "description" : "kernel: sched/rt: Fix race in push_rt_task",
    "id" : "2376375",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2376375"
  },
  "cvss3" : {
    "cvss3_base_score" : "5.5",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
    "status" : "verified"
  },
  "details" : [ "In the Linux kernel, the following vulnerability has been resolved:\nsched/rt: Fix race in push_rt_task\nOverview\n========\nWhen a CPU chooses to call push_rt_task and picks a task to push to\nanother CPU's runqueue then it will call find_lock_lowest_rq method\nwhich would take a double lock on both CPUs' runqueues. If one of the\nlocks aren't readily available, it may lead to dropping the current\nrunqueue lock and reacquiring both the locks at once. During this window\nit is possible that the task is already migrated and is running on some\nother CPU. These cases are already handled. However, if the task is\nmigrated and has already been executed and another CPU is now trying to\nwake it up (ttwu) such that it is queued again on the runqeue\n(on_rq is 1) and also if the task was run by the same CPU, then the\ncurrent checks will pass even though the task was migrated out and is no\nlonger in the pushable tasks list.\nCrashes\n=======\nThis bug resulted in quite a few flavors of crashes triggering kernel\npanics with various crash signatures such as assert failures, page\nfaults, null pointer dereferences, and queue corruption errors all\ncoming from scheduler itself.\nSome of the crashes:\n-> kernel BUG at kernel/sched/rt.c:1616! BUG_ON(idx >= MAX_RT_PRIO)\nCall Trace:\n? __die_body+0x1a/0x60\n? die+0x2a/0x50\n? do_trap+0x85/0x100\n? pick_next_task_rt+0x6e/0x1d0\n? do_error_trap+0x64/0xa0\n? pick_next_task_rt+0x6e/0x1d0\n? exc_invalid_op+0x4c/0x60\n? pick_next_task_rt+0x6e/0x1d0\n? asm_exc_invalid_op+0x12/0x20\n? pick_next_task_rt+0x6e/0x1d0\n__schedule+0x5cb/0x790\n? update_ts_time_stats+0x55/0x70\nschedule_idle+0x1e/0x40\ndo_idle+0x15e/0x200\ncpu_startup_entry+0x19/0x20\nstart_secondary+0x117/0x160\nsecondary_startup_64_no_verify+0xb0/0xbb\n-> BUG: kernel NULL pointer dereference, address: 00000000000000c0\nCall Trace:\n? __die_body+0x1a/0x60\n? no_context+0x183/0x350\n? __warn+0x8a/0xe0\n? exc_page_fault+0x3d6/0x520\n? asm_exc_page_fault+0x1e/0x30\n? pick_next_task_rt+0xb5/0x1d0\n? pick_next_task_rt+0x8c/0x1d0\n__schedule+0x583/0x7e0\n? update_ts_time_stats+0x55/0x70\nschedule_idle+0x1e/0x40\ndo_idle+0x15e/0x200\ncpu_startup_entry+0x19/0x20\nstart_secondary+0x117/0x160\nsecondary_startup_64_no_verify+0xb0/0xbb\n-> BUG: unable to handle page fault for address: ffff9464daea5900\nkernel BUG at kernel/sched/rt.c:1861! BUG_ON(rq->cpu != task_cpu(p))\n-> kernel BUG at kernel/sched/rt.c:1055! BUG_ON(!rq->nr_running)\nCall Trace:\n? __die_body+0x1a/0x60\n? die+0x2a/0x50\n? do_trap+0x85/0x100\n? dequeue_top_rt_rq+0xa2/0xb0\n? do_error_trap+0x64/0xa0\n? dequeue_top_rt_rq+0xa2/0xb0\n? exc_invalid_op+0x4c/0x60\n? dequeue_top_rt_rq+0xa2/0xb0\n? asm_exc_invalid_op+0x12/0x20\n? dequeue_top_rt_rq+0xa2/0xb0\ndequeue_rt_entity+0x1f/0x70\ndequeue_task_rt+0x2d/0x70\n__schedule+0x1a8/0x7e0\n? blk_finish_plug+0x25/0x40\nschedule+0x3c/0xb0\nfutex_wait_queue_me+0xb6/0x120\nfutex_wait+0xd9/0x240\ndo_futex+0x344/0xa90\n? get_mm_exe_file+0x30/0x60\n? audit_exe_compare+0x58/0x70\n? audit_filter_rules.constprop.26+0x65e/0x1220\n__x64_sys_futex+0x148/0x1f0\ndo_syscall_64+0x30/0x80\nentry_SYSCALL_64_after_hwframe+0x62/0xc7\n-> BUG: unable to handle page fault for address: ffff8cf3608bc2c0\nCall Trace:\n? __die_body+0x1a/0x60\n? no_context+0x183/0x350\n? spurious_kernel_fault+0x171/0x1c0\n? exc_page_fault+0x3b6/0x520\n? plist_check_list+0x15/0x40\n? plist_check_list+0x2e/0x40\n? asm_exc_page_fault+0x1e/0x30\n? _cond_resched+0x15/0x30\n? futex_wait_queue_me+0xc8/0x120\n? futex_wait+0xd9/0x240\n? try_to_wake_up+0x1b8/0x490\n? futex_wake+0x78/0x160\n? do_futex+0xcd/0xa90\n? plist_check_list+0x15/0x40\n? plist_check_list+0x2e/0x40\n? plist_del+0x6a/0xd0\n? plist_check_list+0x15/0x40\n? plist_check_list+0x2e/0x40\n? dequeue_pushable_task+0x20/0x70\n? __schedule+0x382/0x7e0\n? asm_sysvec_reschedule_i\n---truncated---" ],
  "affected_release" : [ {
    "product_name" : "Red Hat Enterprise Linux 10",
    "release_date" : "2025-06-23T00:00:00Z",
    "advisory" : "RHSA-2025:9348",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10.0",
    "package" : "kernel-0:6.12.0-55.18.1.el10_0"
  }, {
    "product_name" : "Red Hat Enterprise Linux 10",
    "release_date" : "2025-11-11T00:00:00Z",
    "advisory" : "RHSA-2025:20095",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10.1",
    "package" : "kernel-0:6.12.0-124.8.1.el10_1"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "release_date" : "2025-05-28T00:00:00Z",
    "advisory" : "RHSA-2025:8247",
    "cpe" : "cpe:/a:redhat:enterprise_linux:8::nfv",
    "package" : "kernel-rt-0:4.18.0-553.54.1.rt7.395.el8_10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "release_date" : "2025-05-28T00:00:00Z",
    "advisory" : "RHSA-2025:8246",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8",
    "package" : "kernel-0:4.18.0-553.54.1.el8_10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2025-11-11T00:00:00Z",
    "advisory" : "RHSA-2025:20518",
    "cpe" : "cpe:/a:redhat:enterprise_linux:9",
    "package" : "kernel-0:5.14.0-611.5.1.el9_7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2025-11-11T00:00:00Z",
    "advisory" : "RHSA-2025:20518",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9",
    "package" : "kernel-0:5.14.0-611.5.1.el9_7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9.4 Extended Update Support",
    "release_date" : "2025-06-25T00:00:00Z",
    "advisory" : "RHSA-2025:9584",
    "cpe" : "cpe:/a:redhat:rhel_eus:9.4",
    "package" : "kernel-0:5.14.0-427.74.1.el9_4"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Fix deferred",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Fix deferred",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Fix deferred",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2025-38234\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-38234\nhttps://lore.kernel.org/linux-cve-announce/2025070430-CVE-2025-38234-6984@gregkh/T" ],
  "name" : "CVE-2025-38234",
  "csaw" : false
}