{"id":"DEBIAN-CVE-2025-39749","details":"In the Linux kernel, the following vulnerability has been resolved:  rcu: Protect -\u003edefer_qs_iw_pending from data race  On kernels built with CONFIG_IRQ_WORK=y, when rcu_read_unlock() is invoked within an interrupts-disabled region of code [1], it will invoke rcu_read_unlock_special(), which uses an irq-work handler to force the system to notice when the RCU read-side critical section actually ends. That end won't happen until interrupts are enabled at the soonest.  In some kernels, such as those booted with rcutree.use_softirq=y, the irq-work handler is used unconditionally.  The per-CPU rcu_data structure's -\u003edefer_qs_iw_pending field is updated by the irq-work handler and is both read and updated by rcu_read_unlock_special().  This resulted in the following KCSAN splat:  ------------------------------------------------------------------------  BUG: KCSAN: data-race in rcu_preempt_deferred_qs_handler / rcu_read_unlock_special  read to 0xffff96b95f42d8d8 of 1 bytes by task 90 on cpu 8:  rcu_read_unlock_special+0x175/0x260  __rcu_read_unlock+0x92/0xa0  rt_spin_unlock+0x9b/0xc0  __local_bh_enable+0x10d/0x170  __local_bh_enable_ip+0xfb/0x150  rcu_do_batch+0x595/0xc40  rcu_cpu_kthread+0x4e9/0x830  smpboot_thread_fn+0x24d/0x3b0  kthread+0x3bd/0x410  ret_from_fork+0x35/0x40  ret_from_fork_asm+0x1a/0x30  write to 0xffff96b95f42d8d8 of 1 bytes by task 88 on cpu 8:  rcu_preempt_deferred_qs_handler+0x1e/0x30  irq_work_single+0xaf/0x160  run_irq_workd+0x91/0xc0  smpboot_thread_fn+0x24d/0x3b0  kthread+0x3bd/0x410  ret_from_fork+0x35/0x40  ret_from_fork_asm+0x1a/0x30  no locks held by irq_work/8/88. irq event stamp: 200272 hardirqs last  enabled at (200272): [\u003cffffffffb0f56121\u003e] finish_task_switch+0x131/0x320 hardirqs last disabled at (200271): [\u003cffffffffb25c7859\u003e] __schedule+0x129/0xd70 softirqs last  enabled at (0): [\u003cffffffffb0ee093f\u003e] copy_process+0x4df/0x1cc0 softirqs last disabled at (0): [\u003c0000000000000000\u003e] 0x0  ------------------------------------------------------------------------  The problem is that irq-work handlers run with interrupts enabled, which means that rcu_preempt_deferred_qs_handler() could be interrupted, and that interrupt handler might contain an RCU read-side critical section, which might invoke rcu_read_unlock_special().  In the strict KCSAN mode of operation used by RCU, this constitutes a data race on the -\u003edefer_qs_iw_pending field.  This commit therefore disables interrupts across the portion of the rcu_preempt_deferred_qs_handler() that updates the -\u003edefer_qs_iw_pending field.  This suffices because this handler is not a fast path.","modified":"2026-09-01T16:06:16.015549025Z","published":"2025-09-11T17:15:38.430Z","upstream":["CVE-2025-39749"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2025-39749"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:12","purl":"pkg:deb/debian/linux?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.153-1"}]}],"versions":["6.1.106-1","6.1.106-2","6.1.106-3","6.1.112-1","6.1.115-1","6.1.119-1","6.1.123-1","6.1.124-1","6.1.128-1","6.1.129-1","6.1.133-1","6.1.135-1","6.1.137-1","6.1.139-1","6.1.140-1","6.1.147-1","6.1.148-1","6.1.27-1","6.1.37-1","6.1.38-1","6.1.38-2","6.1.38-2~bpo11+1","6.1.38-3","6.1.38-4","6.1.38-4~bpo11+1","6.1.52-1","6.1.55-1","6.1.55-1~bpo11+1","6.1.64-1","6.1.66-1","6.1.67-1","6.1.69-1","6.1.69-1~bpo11+1","6.1.76-1","6.1.76-1~bpo11+1","6.1.82-1","6.1.85-1","6.1.90-1","6.1.90-1~bpo11+1","6.1.94-1","6.1.94-1~bpo11+1","6.1.98-1","6.1.99-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2025-39749.json"}},{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.43-1"}]}],"versions":["6.12.38-1","6.12.41-1","6.12.43-1~bpo12+1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2025-39749.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.16.3-1"}]}],"versions":["6.12.100-1","6.12.101-1","6.12.105-1","6.12.107-1","6.12.38-1","6.12.41-1","6.12.43-1","6.12.43-1~bpo12+1","6.12.48-1","6.12.57-1","6.12.57-1~bpo12+1","6.12.63-1","6.12.63-1~bpo12+1","6.12.69-1","6.12.69-1~bpo12+1","6.12.73-1","6.12.73-1~bpo12+1","6.12.74-1","6.12.74-2","6.12.74-2~bpo12+1","6.12.85-1","6.12.85-1~bpo12+1","6.12.86-1","6.12.86-1~bpo12+1","6.12.88-1","6.12.88-1~bpo12+1","6.12.90-1","6.12.90-1~bpo12+1","6.12.90-2","6.12.90-2~bpo12+1","6.12.94-1","6.12.94-1~bpo12+1","6.12.95-1","6.12.95-1~bpo12+1","6.12.96-1","6.13.10-1~exp1","6.13.11-1~exp1","6.13.2-1~exp1","6.13.3-1~exp1","6.13.4-1~exp1","6.13.5-1~exp1","6.13.6-1~exp1","6.13.7-1~exp1","6.13.8-1~exp1","6.13.9-1~exp1","6.13~rc6-1~exp1","6.13~rc7-1~exp1","6.14.3-1~exp1","6.14.5-1~exp1","6.14.6-1~exp1","6.15-1~exp1","6.15.1-1~exp1","6.15.2-1~exp1","6.15.3-1~exp1","6.15.4-1~exp1","6.15.5-1~exp1","6.15.6-1~exp1","6.15~rc7-1~exp1","6.16-1~exp1","6.16.1-1~exp1","6.16.3-1~bpo13+1","6.16~rc7-1~exp1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2025-39749.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}