Skip to main content
VulnerabilityPublished Updated

CVE-2025-39681: Linux kernel · x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper

Affects Linux kernelSource CVE Database V5

0
Compare

Not known to be exploited · fixed in fb81222c1559f89bfe3aa1010f6d112531d55353 : update Linux kernel when convenient.

Data as of 5 Nov 2026, 21:48 UTC

Severity
Medium

Rated Medium by Threat Radar's AI analysis · No CVSS score from NVD or the CNA

Thin evidence

One scorer or none
CISA SSVC
Exploitation
No evidence of active exploitation and no public proof of concept
Automatable
Attackers cannot reliably automate steps 1–4 of the kill chain
Technical impact
Limited control over the software or limited information exposure

CISA SSVC assessment, 2026-11-05.

Patch
Available – fixed in fb81222c1559f89bfe3aa1010f6d112531d55353, d23264c257a70dbe021b43b3bc2ee16134cd2c69, d8df126349dad855cdfedd6bbf315bad2e901c2f +4

Exploitation evidence

  1. Disclosed: evidence found.

    CVE published 5 Sep 2025

  2. Detectable: no evidence on record.

    No public nuclei template indexed

  3. Weaponized: no evidence on record.

    No public exploit code indexed in Metasploit or Exploit-DB

  4. Exploited in the wild: no evidence on record.

    Not in CISA KEV and no source reports exploitation

  5. Observed by OffSeq Mirage: no evidence on record.

    No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 5 Nov 2026.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

ProductAffectedFixed in
LinuxLinuxAffected
  • ≥ 923f3a2b48bdccb6a1d1f0dd48de03de7ad936d9, < fb81222c1559f89bfe3aa1010f6d112531d55353
Fixed in
  • fb81222c1559f89bfe3aa1010f6d112531d55353
LinuxLinuxAffected
  • ≥ 923f3a2b48bdccb6a1d1f0dd48de03de7ad936d9, < d23264c257a70dbe021b43b3bc2ee16134cd2c69
Fixed in
  • d23264c257a70dbe021b43b3bc2ee16134cd2c69
LinuxLinuxAffected
  • ≥ 923f3a2b48bdccb6a1d1f0dd48de03de7ad936d9, < d8df126349dad855cdfedd6bbf315bad2e901c2f
Fixed in
  • d8df126349dad855cdfedd6bbf315bad2e901c2f
LinuxLinuxAffected
  • ≥ 923f3a2b48bdccb6a1d1f0dd48de03de7ad936d9, < a9e5924daa954c9f585c1ca00358afe71d6781c4
Fixed in
  • a9e5924daa954c9f585c1ca00358afe71d6781c4
LinuxLinuxAffected
  • ≥ 923f3a2b48bdccb6a1d1f0dd48de03de7ad936d9, < 7207923d8453ebfb35667c1736169f2dd796772e
Fixed in
  • 7207923d8453ebfb35667c1736169f2dd796772e
LinuxLinuxAffected
  • ≥ 923f3a2b48bdccb6a1d1f0dd48de03de7ad936d9, < 873f32201df8876bdb2563e3187e79149427cab4
Fixed in
  • 873f32201df8876bdb2563e3187e79149427cab4

AI-suggested

A fix is available and has been applied in multiple Linux kernel commits identified by hashes fb81222c1559f89bfe3aa1010f6d112531d55353, d23264c257a70dbe021b43b3bc2ee16134cd2c69, d8df126349dad855cdfedd6bbf315bad2e901c2f, a9e5924daa954c9f585c1ca00358afe71d6781c4, 7207923d8453ebfb35667c1736169f2dd796772e, 873f32201df8876bdb2563e3187e79149427cab4, and 62f12cde10118253348a7540e85606869bd69432. Users should update affected Linux kernel versions to include these fixes. The affected version is Linux kernel 5.8. No additional mitigation is required beyond applying the official patch.

Description

A vulnerability in the Linux kernel's x86 CPU initialization for Hygon processors caused a division by zero fault during early boot. This occurred because the function resctrl_cpu_detect() was omitted from the Hygon BSP init helper, leading to uninitialized CPU cache scaling data when certain CPU features were present. The issue has been fixed by adding the missing function call in the affected code path.

References

Community reviews

Loading reviews…