CVE-2025-40163
mediumpriority · track · 0EPSS 0.002 · 10 %ileDEEURUEPSS · scored 2026-10-27
In the Linux kernel, the following vulnerability has been resolved: sched/deadline: Stop dl_server before CPU goes offline IBM CI tool reported kernel warning[1] when running a CPU removal operation through drmgr[2]. i.e "drmgr -c cpu -r -q 1" WARNING: CPU: 0 PID: 0 at kernel/sched/cpudeadline.c:219 cpudl_set+0x58/0x170 NIP [c0000000002b6ed8] cpudl_set+0x58/0x170 LR [c0000000002b7cb8] dl_server_timer+0x168/0x2a0 Call Trace: [c000000002c2f8c0] init_stack+0x78c0/0x8000 (unreliable) [c0000000002b7cb8] dl_server_timer+0x168/0x2a0 [c00000000034df84] __hrtimer_run_queues+0x1a4/0x390 [c00000000034f624] hrtimer_interrupt+0x124/0x300 [c00000000002a230] timer_interrupt+0x140/0x320 Git bisects to: commit 4ae8d9aa9f9d ("sched/deadline: Fix dl_server getting stuck") This happens since: - dl_server hrtimer gets enqueued close to cpu offline, when kthread_park enqueues a fair task. - CPU goes offline and drmgr removes it from cpu_present_mask. - hrtimer fires and warning is hit. Fix it by stopping the dl_server before CPU is marked dead. [1]: https://lore.kernel.org/all/8218e149-7718-4432-9312-f97297c352b9@linux.ibm.com/ [2]: https://github.com/ibm-power-utilities/powerpc-utils/tree/next/src/drmgr [sshegde: wrote the changelog and tested it]
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (35)
Products and version ranges known to be affected.
advisories (1)
Vendor and ecosystem advisories describing this.
- WID-SEC-W-2025-2579Linux Kernel: Mehrere SchwachstellenDeutsch2025-11-11csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen im Linux-Kernel ausnutzen, um nicht näher spezifizierte Angriffe durchzuführen, die möglicherweise zu einer Denial-of-Service- Bedingung führen oder eine Speicherbeschädigung verursachen können.
also known as (4)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (10)
External citations — patches, advisories, analysis.
- https://git.kernel.org/stable/c/ab6c0f158508bb16d483add70b73a73f95651c33cnnvd
- https://git.kernel.org/stable/c/ee6e44dfe6e50b4a5df853d933a96bdff5309e6ecnnvd
- https://vigilance.fr/vulnerability/Linux-kernel-multiple-vulnerabilities-dated-12-11-2025-48734cnnvd
- https://www.kernel.org/Patchcnnvd
- https://git.kernel.org/stable/c/ab6c0f158508bb16d483add70b73a73f95651c33enisa_euvd
- https://git.kernel.org/stable/c/d7fd56ed5e07e053a5eea6112d61fcaded653b87enisa_euvd
- https://git.kernel.org/stable/c/ee6e44dfe6e50b4a5df853d933a96bdff5309e6eenisa_euvd
- https://git.kernel.org/stable/c/ab6c0f158508bb16d483add70b73a73f95651c33nvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan