CVE-2025-40163: 
Linux Kernel vulnerability analysis and mitigation

A vulnerability in the Linux kernel's scheduler component was discovered and resolved, identified as CVE-2025-40163. The issue involves the dl_server functionality during CPU offline operations, which was reported on November 12, 2025. This vulnerability specifically affects the kernel's deadline scheduler implementation (NVD Database).

The vulnerability occurs when the dl_server hrtimer gets enqueued close to CPU offline operations, specifically when kthread_park enqueues a fair task. The issue manifests when the CPU goes offline and drmgr removes it from cpu_present_mask, followed by an hrtimer firing that triggers a kernel warning. The problem was identified in the kernel/sched/cpudeadline.c file at line 219 in the cpudl_set function (NVD Database).

When triggered, the vulnerability results in kernel warnings during CPU removal operations through drmgr, specifically when executing commands like 'drmgr -c cpu -r -q 1'. This could potentially affect system stability and CPU management operations (NVD Database).

The issue is triggered during specific CPU offline operations using the drmgr utility. The vulnerability was discovered through IBM CI tool testing, suggesting it's reproducible under controlled conditions (NVD Database).

The vulnerability has been resolved by implementing a fix that stops the dl_server before the CPU is marked as dead. This solution was implemented in commit 4ae8d9aa9f9d, titled 'sched/deadline: Fix dl_server getting stuck' (NVD Database).