CVE-2025-39745: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-39745 is a Denial of Service vulnerability in the Linux kernel's rcutorture testing module, caused by incorrect preempt_count() handling on kernels built with CONFIG_PREEMPT_RT=y. The flaw causes a kernel warning (splat) during RCU torture tests, potentially leading to kernel instability or panic in real-time Linux environments. It was published on September 11, 2025, and affects Linux kernel versions before 6.15.11 and versions 6.16.x before 6.16.2 (Red Hat CVE, Red Hat Bugzilla). The CVSS v3.1 base score is 5.5 (Medium) (Red Hat CVE).

The root cause is an incorrect use of preempt_count() to check whether bottom-half (BH/softirq) processing is disabled in the rcutorture_one_extend_check() function. On CONFIG_PREEMPT_RT=y kernels, disabling BH does not modify the SOFTIRQ bits in preempt_count() as it does on non-RT kernels, causing the check to produce a false warning. The fix replaces the preempt_count() check with softirq_count(), which correctly reflects BH-disabled state on RT kernels. This is classified as an improper state check / logic error (CWE-754 or similar improper check for unusual conditions) (Red Hat Bugzilla, git.kernel.org).

Exploitation of this vulnerability is limited to local, low-privileged users who can trigger rcutorture tests on affected RT kernels, resulting in a kernel warning and potential system instability or kernel panic (availability impact only). There is no confidentiality or integrity impact. The scope is limited to systems running preemptive real-time Linux kernels (CONFIG_PREEMPT_RT=y) with rcutorture testing enabled, which is typically a testing or specialized embedded/industrial environment rather than general-purpose production systems (Red Hat CVE, Red Hat Bugzilla).

Update to Linux kernel version 6.15.11 or later, or 6.16.2 or later, which include the fix replacing preempt_count() with softirq_count() in rcutorture_one_extend_check(). Patches are available from the upstream Linux kernel stable repositories (git.kernel.org, git.kernel.org, git.kernel.org). As a temporary workaround, disabling or avoiding rcutorture tests on CONFIG_PREEMPT_RT=y systems mitigates the risk until patching is possible (Red Hat Bugzilla).