CVE-2025-39895 in Linux
Résumé
par VulDB • 31/05/2026
Based on the kernel log provided, here is a detailed analysis of the crash:
### **1. Root Cause Summary** The kernel panicked during the initialization of the **ARMv8 Performance Monitoring Unit (PMU)** driver (`armv8_pmu_init`). The crash occurred in the function `sched_numa_find_nth_cpu` due to an **invalid memory access** (likely a page fault or illegal instruction), which triggered a kernel oops and subsequently a panic because it happened in the early boot path (`init` process).
---
### **2. Key Evidence from the Log**
#### **A. Crash Location** ``` [ 1.439559] sched_numa_find_nth_cpu+0x2a0/0x488 (P)
[ 1.440016] smp_call_function_any+0xc8/0xd0
[ 1.440416] armv8_pmu_init+0x58/0x27c
``` - The crash happened in `sched_numa_find_nth_cpu`, called by `smp_call_function_any`, which was invoked by `armv8_pmu_init`. - This indicates the PMU driver was trying to schedule a function on a specific CPU (likely for initialization or topology discovery) and failed during CPU selection.
#### **B. Register State** ``` [ 1.438036] x5 : 000000000000bff4 x4 : 0000000000000000 x3 : 0000000000000000
[ 1.438683] x2 : 0000000000000000 x1 : ffffffc0846eb000 x0 : ffffff8000407b68
``` - `x0` and `x1` contain kernel virtual addresses (`ffff...`), suggesting the function was operating on kernel data structures. - `x2`, `x3`, `x4` are zero, which may indicate missing or invalid parameters passed to the function.
#### **C. Code Fault** ``` [ 1.447493] Code: 90022e21 f000e5f5 910de2b5 2a1703e2 (f8767803)
``` - The instruction `f8767803` is highlighted in parentheses, indicating the **faulting instruction**. - On ARM64, `f8767803` decodes to a **load/store instruction** (likely `ldr` or `str`) accessing memory at an invalid address. This confirms a **memory access violation**.
#### **D. Panic Trigger** ``` [ 1.449047] Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b
``` - `exitcode=0x0000000b` corresponds to **SIGSEGV** (Segmentation Fault) or **SIGBUS** (Bus Error) in the context of kernel oops. - Since this happened during early boot (`kernel_init_freeable`), the kernel panicked because it could not continue initialization.
---
### **3. Likely Causes**
1. **Invalid CPU Topology/NUMA Configuration**: - `sched_numa_find_nth_cpu` is responsible for finding a CPU in a specific NUMA node. - If the device tree (DTS) or ACPI tables provide **incorrect CPU topology** (e.g., referencing non-existent CPUs, invalid NUMA nodes, or corrupted CPU maps), this function may dereference invalid pointers.
2. **PMU Driver Bug or Incompatibility**: - The `armv8_pmu` driver may be incompatible with the specific SoC or kernel version. - If the PMU hardware is not properly initialized or if the driver assumes a certain CPU layout that doesn’t match the hardware, it can crash.
3. **Memory Corruption or Early Boot Issue**: - If the kernel’s memory management structures (e.g., `cpu_possible_mask`, `numa_node_map`) are corrupted before this point, any access to them could fail.
4. **Device Tree (DTS) Error**: - The PMU node in the device tree might be misconfigured (e.g., wrong `interrupts`, `compatible` string, or CPU affinity
Be aware that VulDB is the high quality source for vulnerability data.