CVE-2025-39681

x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper

Published Sep 5, 2025 CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper

Since

923f3a2b48bd ("x86/resctrl: Query LLC monitoring properties once during boot")

resctrl_cpu_detect() has been moved from common CPU initialization code to
the vendor-specific BSP init helper, while Hygon didn't put that call in their
code.

This triggers a division by zero fault during early booting stage on our
machines with X86_FEATURE_CQM* supported, where get_rdt_mon_resources() tries
to calculate mon_l3_config with uninitialized boot_cpu_data.x86_cache_occ_scale.

Add the missing resctrl_cpu_detect() in the Hygon BSP init helper.

[ bp: Massage commit message. ]

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`923f3a2b48bdccb6a1d1f0dd48de03de7ad936d9`	affected	< 62f12cde10118253348a7540e85606869bd69432
`923f3a2b48bdccb6a1d1f0dd48de03de7ad936d9`	affected	< 873f32201df8876bdb2563e3187e79149427cab4
`923f3a2b48bdccb6a1d1f0dd48de03de7ad936d9`	affected	< fb81222c1559f89bfe3aa1010f6d112531d55353
`923f3a2b48bdccb6a1d1f0dd48de03de7ad936d9`	affected	< 7207923d8453ebfb35667c1736169f2dd796772e
`923f3a2b48bdccb6a1d1f0dd48de03de7ad936d9`	affected	< a9e5924daa954c9f585c1ca00358afe71d6781c4
`923f3a2b48bdccb6a1d1f0dd48de03de7ad936d9`	affected	< d23264c257a70dbe021b43b3bc2ee16134cd2c69
`923f3a2b48bdccb6a1d1f0dd48de03de7ad936d9`	affected	< d8df126349dad855cdfedd6bbf315bad2e901c2f

Linux

affected

Version	Status	Constraints
`5.8`	affected	—
`0`	unaffected	< 5.8
`5.10.242`	unaffected	≤ 5.10.*
`5.15.190`	unaffected	≤ 5.15.*
`6.1.149`	unaffected	≤ 6.1.*
`6.6.103`	unaffected	≤ 6.6.*
`6.12.44`	unaffected	≤ 6.12.*
`6.16.4`	unaffected	≤ 6.16.*
`6.17`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel:6.17:rc1::::::
	cpe:2.3:o:linux:linux_kernel:6.17:rc2::::::

Configuration 2 [-]

cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*

No data.

Vendor	Product	Versions
Linux	Linux Kernel	—

Remediation

No solution or workaround provided in the CVE record

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4327-1	linux security update
Debian DLA	DLA-4328-1	linux-6.1 security update
Debian DSA	DSA-6008-1	linux security update
Debian DSA	DSA-6009-1	linux security update
EUVD	EUVD-2025-31543	In the Linux kernel, the following vulnerability has been resolved: x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper Since 923f3a2b48bd ("x86/resctrl: Query LLC monitoring properties once during boot") resctrl_cpu_detect() has been moved from common CPU initialization code to the vendor-specific BSP init helper, while Hygon didn't put that call in their code. This triggers a division by zero fault during early booting stage on our machines with X86_FEATURE_CQM* supported, where get_rdt_mon_resources() tries to calculate mon_l3_config with uninitialized boot_cpu_data.x86_cache_occ_scale. Add the missing resctrl_cpu_detect() in the Hygon BSP init helper. [ bp: Massage commit message. ]
Ubuntu USN	USN-7909-1	Linux kernel vulnerabilities
Ubuntu USN	USN-7909-2	Linux kernel (Real-time) vulnerabilities
Ubuntu USN	USN-7909-3	Linux kernel (FIPS) vulnerabilities
Ubuntu USN	USN-7910-1	Linux kernel (Azure FIPS) vulnerabilities
Ubuntu USN	USN-7909-4	Linux kernel vulnerabilities
Ubuntu USN	USN-7910-2	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-7909-5	Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN	USN-7933-1	Linux kernel (KVM) vulnerabilities
Ubuntu USN	USN-7938-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8028-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8028-2	Linux kernel (Real-time) vulnerabilities
Ubuntu USN	USN-8031-1	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8028-3	Linux kernel (Real-time) vulnerabilities
Ubuntu USN	USN-8028-4	Linux kernel (FIPS) vulnerabilities
Ubuntu USN	USN-8028-5	Linux kernel vulnerabilities
Ubuntu USN	USN-8031-2	Linux kernel (GCP FIPS) vulnerabilities
Ubuntu USN	USN-8028-6	Linux kernel (HWE) vulnerabilities
Ubuntu USN	USN-8031-3	Linux kernel vulnerabilities
Ubuntu USN	USN-8052-1	Linux kernel (Low Latency) vulnerabilities
Ubuntu USN	USN-8028-7	Linux kernel (Low Latency NVIDIA) vulnerabilities
Ubuntu USN	USN-8028-8	Linux kernel (IBM) vulnerabilities
Ubuntu USN	USN-8052-2	Linux kernel (Xilinx) vulnerabilities
Ubuntu USN	USN-8074-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8074-2	Linux kernel (Azure FIPS) vulnerabilities
Ubuntu USN	USN-8126-1	Linux kernel (Azure) vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.183% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://cert-portal.siemens.com/productcert/html/ssa-019113.html
https://cert-portal.siemens.com/productcert/html/ssa-032379.html
https://cert-portal.siemens.com/productcert/html/ssa-457936.html
https://git.kernel.org/stable/c/62f12cde10118253348a7540e85606869bd69432
https://git.kernel.org/stable/c/7207923d8453ebfb35667c1736169f2dd796772e
https://git.kernel.org/stable/c/873f32201df8876bdb2563e3187e79149427cab4
https://git.kernel.org/stable/c/a9e5924daa954c9f585c1ca00358afe71d6781c4
https://git.kernel.org/stable/c/d23264c257a70dbe021b43b3bc2ee16134cd2c69
https://git.kernel.org/stable/c/d8df126349dad855cdfedd6bbf315bad2e901c2f
https://git.kernel.org/stable/c/fb81222c1559f89bfe3aa1010f6d112531d55353
https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html
https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html
https://lore.kernel.org/linux-cve-announce/2025090545-CVE-2025-39681-ac80@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2025-39681
https://www.cve.org/CVERecord?id=CVE-2025-39681

History

Nov 6, 2026 7:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Oct 15, 2026 2:30 AM Added references View changes

Type	Values Removed	Values Added
References		https://cert-portal.siemens.com/productcert/html/ssa-457936.html

May 12, 2026 1:30 PM Added references View changes

Type	Values Removed	Values Added
References		https://cert-portal.siemens.com/productcert/html/ssa-032379.html

Jan 8, 2026 3:45 PM First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Debian Debian debian Linux
Weaknesses		NVD-CWE-noinfo
CPEs		cpe:2.3:o:debian:debian_linux:11.0:::::::* cpe:2.3:o:linux:linux_kernel:::::::: cpe:2.3:o:linux:linux_kernel:6.17:rc1:::::: cpe:2.3:o:linux:linux_kernel:6.17:rc2::::::
Vendors & Products		Debian Debian debian Linux

Nov 3, 2025 6:30 PM Added references View changes

Type	Values Removed	Values Added
References		https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html

Sep 8, 2025 6:30 AM Added references View changes

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/62f12cde10118253348a7540e85606869bd69432

Sep 7, 2025 4:00 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Linux Linux linux Kernel
Vendors & Products		Linux Linux linux Kernel

Sep 6, 2025 12:15 AM Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
References		https://lore.kernel.org/linux-cve-announce/2025090545-CVE-2025-39681-ac80@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2025-39681 https://www.cve.org/CVERecord?id=CVE-2025-39681
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Low`

Sep 5, 2025 5:30 PM Description updated. Title updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper Since 923f3a2b48bd ("x86/resctrl: Query LLC monitoring properties once during boot") resctrl_cpu_detect() has been moved from common CPU initialization code to the vendor-specific BSP init helper, while Hygon didn't put that call in their code. This triggers a division by zero fault during early booting stage on our machines with X86_FEATURE_CQM* supported, where get_rdt_mon_resources() tries to calculate mon_l3_config with uninitialized boot_cpu_data.x86_cache_occ_scale. Add the missing resctrl_cpu_detect() in the Hygon BSP init helper. [ bp: Massage commit message. ]
Title		x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper
References		https://git.kernel.org/stable/c/7207923d8453ebfb35667c1736169f2dd796772e https://git.kernel.org/stable/c/873f32201df8876bdb2563e3187e79149427cab4 https://git.kernel.org/stable/c/a9e5924daa954c9f585c1ca00358afe71d6781c4 https://git.kernel.org/stable/c/d23264c257a70dbe021b43b3bc2ee16134cd2c69 https://git.kernel.org/stable/c/d8df126349dad855cdfedd6bbf315bad2e901c2f https://git.kernel.org/stable/c/fb81222c1559f89bfe3aa1010f6d112531d55353