In the Linux kernel, the following vulnerability has been resolved:
rcu: Protect ->deferqsiw_pending from data race
On kernels built with CONFIGIRQWORK=y, when rcureadunlock() is invoked within an interrupts-disabled region of code [1], it will invoke rcureadunlock_special(), which uses an irq-work handler to force the system to notice when the RCU read-side critical section actually ends. That end won't happen until interrupts are enabled at the soonest.
In some kernels, such as those booted with rcutree.use_softirq=y, the irq-work handler is used unconditionally.
The per-CPU rcudata structure's ->deferqsiwpending field is updated by the irq-work handler and is both read and updated by rcureadunlock_special(). This resulted in the following KCSAN splat:
BUG: KCSAN: data-race in rcupreemptdeferredqshandler / rcureadunlock_special
read to 0xffff96b95f42d8d8 of 1 bytes by task 90 on cpu 8: rcureadunlockspecial+0x175/0x260 _rcureadunlock+0x92/0xa0 rtspinunlock+0x9b/0xc0 _localbhenable+0x10d/0x170 _localbhenableip+0xfb/0x150 rcudobatch+0x595/0xc40 rcucpukthread+0x4e9/0x830 smpbootthreadfn+0x24d/0x3b0 kthread+0x3bd/0x410 retfromfork+0x35/0x40 retfromforkasm+0x1a/0x30
write to 0xffff96b95f42d8d8 of 1 bytes by task 88 on cpu 8: rcupreemptdeferredqshandler+0x1e/0x30 irqworksingle+0xaf/0x160 runirqworkd+0x91/0xc0 smpbootthreadfn+0x24d/0x3b0 kthread+0x3bd/0x410 retfromfork+0x35/0x40 retfromfork_asm+0x1a/0x30
no locks held by irqwork/8/88. irq event stamp: 200272 hardirqs last enabled at (200272): [<ffffffffb0f56121>] finishtaskswitch+0x131/0x320 hardirqs last disabled at (200271): [<ffffffffb25c7859>] _schedule+0x129/0xd70 softirqs last enabled at (0): [<ffffffffb0ee093f>] copy_process+0x4df/0x1cc0 softirqs last disabled at (0): [<0000000000000000>] 0x0
The problem is that irq-work handlers run with interrupts enabled, which means that rcupreemptdeferredqshandler() could be interrupted, and that interrupt handler might contain an RCU read-side critical section, which might invoke rcureadunlockspecial(). In the strict KCSAN mode of operation used by RCU, this constitutes a data race on the ->deferqsiwpending field.
This commit therefore disables interrupts across the portion of the rcupreemptdeferredqshandler() that updates the ->deferqsiw_pending field. This suffices because this handler is not a fast path.
[
    {
        "signature_type": "Line",
        "target": {
            "file": "kernel/rcu/tree_plugin.h"
        },
        "id": "CVE-2025-39749-052576bc",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e35e711c78c8a4c43330c0dcb1c4d507a19c20f4",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "201768800555794995055009502616991054412",
                "311486980746503986088442222180412829776",
                "231155235721008001477720820857694906717",
                "204278741731905807511527825121768848246",
                "315704284133454195175900977804896717024",
                "107083139665207354548731067225173029846",
                "321944368341733834840415106342556628262"
            ]
        },
        "deprecated": false,
        "signature_version": "v1"
    },
    {
        "signature_type": "Function",
        "target": {
            "function": "rcu_preempt_deferred_qs_handler",
            "file": "kernel/rcu/tree_plugin.h"
        },
        "id": "CVE-2025-39749-0a85ae81",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@90de9c94ea72327cfa9c2c9f6113c23a513af60b",
        "digest": {
            "function_hash": "330863129897691155200954317997376036335",
            "length": 147.0
        },
        "deprecated": false,
        "signature_version": "v1"
    },
    {
        "signature_type": "Function",
        "target": {
            "function": "rcu_preempt_deferred_qs_handler",
            "file": "kernel/rcu/tree_plugin.h"
        },
        "id": "CVE-2025-39749-0b686fc9",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@55e11f6776798b27cf09a7aa0d718415d4fc9cf5",
        "digest": {
            "function_hash": "330863129897691155200954317997376036335",
            "length": 147.0
        },
        "deprecated": false,
        "signature_version": "v1"
    },
    {
        "signature_type": "Line",
        "target": {
            "file": "kernel/rcu/tree_plugin.h"
        },
        "id": "CVE-2025-39749-192fab73",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@90c09d57caeca94e6f3f87c49e96a91edd40cbfd",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "201768800555794995055009502616991054412",
                "311486980746503986088442222180412829776",
                "231155235721008001477720820857694906717",
                "204278741731905807511527825121768848246",
                "315704284133454195175900977804896717024",
                "107083139665207354548731067225173029846",
                "321944368341733834840415106342556628262"
            ]
        },
        "deprecated": false,
        "signature_version": "v1"
    },
    {
        "signature_type": "Line",
        "target": {
            "file": "kernel/rcu/tree_plugin.h"
        },
        "id": "CVE-2025-39749-32cd3682",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b5de8d80b5d049f051b95d9b1ee50ae4ab656124",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "201768800555794995055009502616991054412",
                "311486980746503986088442222180412829776",
                "231155235721008001477720820857694906717",
                "204278741731905807511527825121768848246",
                "315704284133454195175900977804896717024",
                "107083139665207354548731067225173029846",
                "321944368341733834840415106342556628262"
            ]
        },
        "deprecated": false,
        "signature_version": "v1"
    },
    {
        "signature_type": "Function",
        "target": {
            "function": "rcu_preempt_deferred_qs_handler",
            "file": "kernel/rcu/tree_plugin.h"
        },
        "id": "CVE-2025-39749-357040b8",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e35e711c78c8a4c43330c0dcb1c4d507a19c20f4",
        "digest": {
            "function_hash": "330863129897691155200954317997376036335",
            "length": 147.0
        },
        "deprecated": false,
        "signature_version": "v1"
    },
    {
        "signature_type": "Function",
        "target": {
            "function": "rcu_preempt_deferred_qs_handler",
            "file": "kernel/rcu/tree_plugin.h"
        },
        "id": "CVE-2025-39749-767fc86a",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0ad84d62217488e679ecc90e8628980dcc003de3",
        "digest": {
            "function_hash": "330863129897691155200954317997376036335",
            "length": 147.0
        },
        "deprecated": false,
        "signature_version": "v1"
    },
    {
        "signature_type": "Function",
        "target": {
            "function": "rcu_preempt_deferred_qs_handler",
            "file": "kernel/rcu/tree_plugin.h"
        },
        "id": "CVE-2025-39749-7d52c007",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@90c09d57caeca94e6f3f87c49e96a91edd40cbfd",
        "digest": {
            "function_hash": "330863129897691155200954317997376036335",
            "length": 147.0
        },
        "deprecated": false,
        "signature_version": "v1"
    },
    {
        "signature_type": "Line",
        "target": {
            "file": "kernel/rcu/tree_plugin.h"
        },
        "id": "CVE-2025-39749-9080772e",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@90de9c94ea72327cfa9c2c9f6113c23a513af60b",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "201768800555794995055009502616991054412",
                "311486980746503986088442222180412829776",
                "231155235721008001477720820857694906717",
                "204278741731905807511527825121768848246",
                "315704284133454195175900977804896717024",
                "107083139665207354548731067225173029846",
                "321944368341733834840415106342556628262"
            ]
        },
        "deprecated": false,
        "signature_version": "v1"
    },
    {
        "signature_type": "Line",
        "target": {
            "file": "kernel/rcu/tree_plugin.h"
        },
        "id": "CVE-2025-39749-c35d4db7",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0ad84d62217488e679ecc90e8628980dcc003de3",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "201768800555794995055009502616991054412",
                "311486980746503986088442222180412829776",
                "231155235721008001477720820857694906717",
                "204278741731905807511527825121768848246",
                "315704284133454195175900977804896717024",
                "107083139665207354548731067225173029846",
                "321944368341733834840415106342556628262"
            ]
        },
        "deprecated": false,
        "signature_version": "v1"
    },
    {
        "signature_type": "Line",
        "target": {
            "file": "kernel/rcu/tree_plugin.h"
        },
        "id": "CVE-2025-39749-de9d03c9",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@55e11f6776798b27cf09a7aa0d718415d4fc9cf5",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "201768800555794995055009502616991054412",
                "311486980746503986088442222180412829776",
                "231155235721008001477720820857694906717",
                "204278741731905807511527825121768848246",
                "315704284133454195175900977804896717024",
                "107083139665207354548731067225173029846",
                "321944368341733834840415106342556628262"
            ]
        },
        "deprecated": false,
        "signature_version": "v1"
    },
    {
        "signature_type": "Line",
        "target": {
            "file": "kernel/rcu/tree_plugin.h"
        },
        "id": "CVE-2025-39749-e89e624b",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b55947b725f190396f475d5d0c59aa855a4d8895",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "201768800555794995055009502616991054412",
                "311486980746503986088442222180412829776",
                "231155235721008001477720820857694906717",
                "204278741731905807511527825121768848246",
                "315704284133454195175900977804896717024",
                "107083139665207354548731067225173029846",
                "321944368341733834840415106342556628262"
            ]
        },
        "deprecated": false,
        "signature_version": "v1"
    },
    {
        "signature_type": "Function",
        "target": {
            "function": "rcu_preempt_deferred_qs_handler",
            "file": "kernel/rcu/tree_plugin.h"
        },
        "id": "CVE-2025-39749-ea999fb7",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b5de8d80b5d049f051b95d9b1ee50ae4ab656124",
        "digest": {
            "function_hash": "330863129897691155200954317997376036335",
            "length": 147.0
        },
        "deprecated": false,
        "signature_version": "v1"
    },
    {
        "signature_type": "Function",
        "target": {
            "function": "rcu_preempt_deferred_qs_handler",
            "file": "kernel/rcu/tree_plugin.h"
        },
        "id": "CVE-2025-39749-fc38e2bb",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b55947b725f190396f475d5d0c59aa855a4d8895",
        "digest": {
            "function_hash": "330863129897691155200954317997376036335",
            "length": 147.0
        },
        "deprecated": false,
        "signature_version": "v1"
    }
]