CVE-2025-39895 in Linux
요약
\~에 의해 VulDB • 2026. 05. 10.
Based on the kernel panic log provided, here is a detailed analysis of the crash, its root cause, and potential solutions.
### 1. Summary of the Crash * **Error Type:** Kernel Panic (`Attempted to kill init!`) * **Trigger:** An **Illegal Instruction** exception (`exitcode=0x0000000b` corresponds to SIGILL). * **Failing Function:** `sched_numa_find_nth_cpu` * **Context:** The crash occurred during the initialization of the ARMv8 Performance Monitoring Unit (PMU), specifically when trying to initialize the Cortex-A72 PMU driver.
### 2. Detailed Analysis
#### A. The Immediate Cause: Illegal Instruction The line: ``` [ 1.447493] Code: 90022e21 f000e5f5 910de2b5 2a1703e2 (f8767803)
``` The instruction `f8767803` is highlighted in parentheses. This is the instruction that caused the fault. * `f8767803` in ARM64 assembly decodes to a **Load Register (literal)** or similar memory access instruction, but the context suggests it might be an **unimplemented or reserved instruction** for the specific CPU core or kernel configuration. * More likely, this is a **branch to an invalid address** or an instruction that the CPU does not support in the current execution mode (e.g., trying to execute a feature like `LSE` atomics or `PAN` that isn't properly enabled or supported by the hardware/firmware).
#### B. The Call Trace The crash happened deep in the scheduler/PMU initialization path: 1. `armv8_pmu_device_probe` → `armv8_pmu_init` → `smp_call_function_any` → `sched_numa_find_nth_cpu` 2. The kernel was trying to find a suitable CPU to run the PMU initialization code on a NUMA node. 3. `sched_numa_find_nth_cpu` is part of the scheduler's NUMA balancing logic.
#### C. Why did it crash here? The most common reasons for this specific crash pattern on ARM64 (especially Cortex-A72) are:
1. **CPU Feature Mismatch:** The kernel was compiled with support for certain CPU features (e.g., LSE, PAN, or specific PMU extensions) that are **not present** on the actual hardware, or vice versa. The kernel assumes a feature is available, but the CPU doesn't support it, leading to an illegal instruction when that code path is executed. 2. **Incompatible Kernel/CPU Combination:** You might be running a kernel that expects a newer CPU feature set than the Cortex-A72 provides, or the kernel's CPU detection logic is flawed. 3. **Corrupted Kernel Image:** The kernel binary might be corrupted or improperly linked. 4. **Device Tree (DTB) Issue:** The Device Tree might incorrectly describe the CPU capabilities or PMU nodes, causing the kernel to probe hardware that doesn't exist or isn't compatible.
### 3. Recommended Solutions
#### Step 1: Verify CPU and Kernel Compatibility * **Check your kernel configuration:** Ensure that `CONFIG_ARM64_CPU_FEATURES` and related PMU options are correctly set for the Cortex-A72. * **Try a different kernel version:** If you are using a very new kernel, try an older LTS version (e.g., 5.10, 5.15, or 6.1) to see if the issue persists. Conversely, if you are on an old kernel, try a newer one. * **Check for known bugs:** Search for "Cortex-A72 kernel panic sched_numa_find_nth_cpu" to see if this is a known issue with your specific kernel version.
#### Step 2: Disable NUMA Balancing (Temporary Workaround) Since the crash occurs in `sched_numa_find_nth_cpu`, you can try disabling NUMA balancing to see if the system boots. * **Boot parameter:** Add `numa=off` or `numa_balancing=disable` to your kernel command line. * Example: `console=ttyS0,115200 root=/dev/mmcblk0p2 rw numa=off`
#### Step 3: Disable PMU Initialization (Temporary Workaround) If you don't need performance monitoring, you can try to disable the PMU driver. * **Boot parameter:** Add `nohlt` or `pmu=disable` (if supported by your kernel). * **Kernel config:** Disable `CONFIG_ARMV8_PMU`
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.