CVE-2025-39681 in Linux
Summary
by MITRE • 09/05/2025
In the Linux kernel, the following vulnerability has been resolved:
x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper
Since
923f3a2b48bd ("x86/resctrl: Query LLC monitoring properties once during boot")
resctrl_cpu_detect() has been moved from common CPU initialization code to the vendor-specific BSP init helper, while Hygon didn't put that call in their code.
This triggers a division by zero fault during early booting stage on our machines with X86_FEATURE_CQM* supported, where get_rdt_mon_resources() tries to calculate mon_l3_config with uninitialized boot_cpu_data.x86_cache_occ_scale.
Add the missing resctrl_cpu_detect() in the Hygon BSP init helper.
[ bp: Massage commit message. ]
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 02/09/2026
This vulnerability exists in the Linux kernel's x86 CPU initialization code specifically affecting Hygon processor implementations. The issue stems from a regression introduced in commit 923f3a2b48bd titled "x86/resctrl: Query LLC monitoring properties once during boot" which relocated the resctrl_cpu_detect() function call from generic CPU initialization code to vendor-specific bootstrap processor (BSP) initialization helpers. While the change was properly implemented for Intel and AMD processors, the Hygon BSP initialization helper was overlooked, creating a critical omission in the boot sequence.
The technical flaw manifests as a division by zero exception occurring during early boot stages on systems supporting X86_FEATURE_CQM* features. When the system attempts to initialize resource control monitoring capabilities through get_rdt_mon_resources(), it tries to calculate mon_l3_config using boot_cpu_data.x86_cache_occ_scale which remains uninitialized due to the missing resctrl_cpu_detect() call. This uninitialized variable causes the division operation to fail catastrophically, preventing proper system boot and rendering affected systems non-functional during the critical early boot phase.
The operational impact of this vulnerability is severe as it affects the boot process of Hygon-based systems that support Cache Quality Monitoring features, potentially causing complete system failures or requiring manual intervention to recover. Systems utilizing Hygon processors with CQM support capabilities are particularly vulnerable, with the issue manifesting as kernel oops or system hangs during boot sequence. The vulnerability affects both server and workstation deployments using Hygon CPUs, creating a significant risk for enterprise environments relying on these processors.
Mitigation strategies should focus on applying the kernel patch that adds the missing resctrl_cpu_detect() call to the Hygon BSP initialization helper, ensuring proper initialization of the x86_cache_occ_scale variable before it is used in division operations. Organizations should prioritize updating their kernel versions to include the fix, particularly those running critical infrastructure on Hygon processors. Additionally, system administrators should monitor for boot failures and verify that CQM monitoring capabilities initialize correctly after applying the patch, as this vulnerability affects the fundamental boot process rather than runtime operations.
This vulnerability maps to CWE-476 which describes NULL pointer dereference, though in this case the issue is more accurately characterized as uninitialized variable usage leading to arithmetic exceptions. The flaw demonstrates poor adherence to the principle of least privilege and proper initialization sequence, common in low-level kernel development where uninitialized state can lead to catastrophic failures. From an ATT&CK perspective, this vulnerability could be leveraged in supply chain attacks targeting specific hardware platforms or in denial-of-service scenarios during system boot, making it a significant concern for system integrity and availability.