CVE-2025-39681 Details
Description
In the Linux kernel, the following vulnerability has been resolved: x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper Since 923f3a2b48bd ("x86/resctrl: Query LLC monitoring properties once during boot") resctrl_cpu_detect() has been moved from common CPU initialization code to the vendor-specific BSP init helper, while Hygon didn't put that call in their code. This triggers a division by zero fault during early booting stage on our machines with X86_FEATURE_CQM* supported, where get_rdt_mon_resources() tries to calculate mon_l3_config with uninitialized boot_cpu_data.x86_cache_occ_scale. Add the missing resctrl_cpu_detect() in the Hygon BSP init helper. [ bp: Massage commit message. ]
A vulnerability in the Linux kernel's handling of Hygon CPUs can lead to a division by zero error during the early boot process. This issue arises because the Hygon-specific initialization routine for the CPU does not properly call a function that detects and configures resource monitoring properties. As a result, certain data needed for cache monitoring is uninitialized, causing a fault. This vulnerability affects Linux kernel versions that include the problematic Hygon initialization, specifically in the stable branch.
Users can upgrade to a patched version of the Linux kernel where this vulnerability has been addressed. The specific commit that fixes this issue is available in the Linux kernel stable tree.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://cert-portal.siemens.com/productcert/html/ssa-019113.html | siemens-SADP | |
| https://cert-portal.siemens.com/productcert/html/ssa-032379.html | siemens-SADP | |
| https://git.kernel.org/stable/c/62f12cde10118253348a7540e85606869bd69432 | kernel.org | Patch |
| https://git.kernel.org/stable/c/7207923d8453ebfb35667c1736169f2dd796772e | kernel.org | Patch |
| https://git.kernel.org/stable/c/873f32201df8876bdb2563e3187e79149427cab4 | kernel.org | Patch |
| https://git.kernel.org/stable/c/a9e5924daa954c9f585c1ca00358afe71d6781c4 | kernel.org | Patch |
| https://git.kernel.org/stable/c/d23264c257a70dbe021b43b3bc2ee16134cd2c69 | kernel.org | Patch |
| https://git.kernel.org/stable/c/d8df126349dad855cdfedd6bbf315bad2e901c2f | kernel.org | Patch |
| https://git.kernel.org/stable/c/fb81222c1559f89bfe3aa1010f6d112531d55353 | kernel.org | Patch |
| https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html | CVE | Third Party Advisory |
| https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html | CVE | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| NVD-CWE-noinfo | Insufficient Information to Classify Weakness | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 5.8, < 5.10.242 >= 5.11, < 5.15.190 >= 5.16, < 6.1.149 >= 6.2, < 6.6.103 >= 6.7, < 6.12.44 >= 6.13, < 6.16.4 6.17 rc1 6.17 rc2 |
CPE
Remediation
| |
| debian debian linux | 11.0 |
CPE
Remediation
| |
Change History
8 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 14, 2026 | CVE Modified | siemens-SADP |
| Jun 17, 2026 | CVE Modified | siemens-SADP |
| Jun 17, 2026 | CVE Modified | kernel.org |
| May 12, 2026 | CVE Modified | siemens-SADP |
| Jan 8, 2026 | Initial Analysis | [email protected] |
| Nov 3, 2025 | CVE Modified | CVE |
| Sep 8, 2025 | CVE Modified | kernel.org |
| Sep 5, 2025 | New CVE Received | kernel.org |