CVE-2025-39745
kernel: Linux kernel: Denial of Service in rcutorture due to incorrect preempt_count handling
Severity
LowRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · September 11, 2025
Updated · June 30, 2026
Description
A flaw was found in the Linux kernel. When running rcutorture tests on systems built with CONFIG_PREEMPT_RT=y (Real-Time) kernels, a local user could trigger a kernel warning or crash, also known as a 'splat'. This occurs because the rcutorture_one_extend_check() function incorrectly uses preempt_count() instead of softirq_count() to verify if Bottom Half (BH) processing is disabled, leading to a Denial of Service (DoS).
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
To mitigate this issue, prevent the rcutorture kernel module from loading. This can be achieved by blacklisting the module.
Create a file /etc/modprobe.d/blacklist-rcutorture.conf with the following content:
blacklist rcutorture
After creating the file, regenerate the initramfs and reboot the system for the changes to take effect:
dracut -f -v
reboot
This mitigation may impact kernel development or testing environments that rely on the rcutorture module. A system reboot is required for the changes to take effect.
CVSS / CWE
CVSS 3.1 · 5.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-367 · Time-of-check Time-of-use (TOCTOU) Race Condition