CVE-2025-40163: 
Linux Ubuntu vulnerability analysis and mitigation

A vulnerability in the Linux kernel's scheduler component was discovered and resolved, identified as CVE-2025-40163. The issue involves the dl_server functionality during CPU offline operations, which was reported on November 12, 2025. This vulnerability specifically affects the kernel's deadline scheduler implementation (NVD Database).

The vulnerability occurs when the dl_server hrtimer gets enqueued close to CPU offline operations, specifically when kthread_park enqueues a fair task. The issue manifests when the CPU goes offline and drmgr removes it from cpu_present_mask, followed by an hrtimer firing that triggers a kernel warning. The problem was identified in the kernel/sched/cpudeadline.c file at line 219 in the cpudl_set function (NVD Database).

When triggered, the vulnerability results in kernel warnings during CPU removal operations through drmgr, specifically when executing commands like 'drmgr -c cpu -r -q 1'. This could potentially affect system stability and CPU management operations (NVD Database).

The vulnerability has been resolved by implementing a fix that stops the dl_server before the CPU is marked as dead. This solution was implemented in commit 4ae8d9aa9f9d, titled 'sched/deadline: Fix dl_server getting stuck' (NVD Database).