sched: Fix sched_numa_find_nth_cpu() if mask offline

{
  "id": "eb8eb2a3410959e1b72c43f55c24480035b19ec1fa3f3b85efd66f374d0ec849",
  "url": "https://osv.dev/vulnerability/CVE-2025-39895",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "sched: Fix sched_numa_find_nth_cpu() if mask offline",
    "summary": "In the Linux kernel, the following vulnerability has been resolved: sched: Fix sched_numa_find_nth_cpu() if mask offline sched_numa_find_nth_cpu() uses a bsearch to look for the 'closest' CPU in sched_domains_numa_masks and given cpus mask. However they might not intersect if all CPUs in the cpus mask are offline. bsearch will return NULL in that case, bail out instead of dereferencing a bogus pointer. The previous behaviour lead to this bug when using maxcpus=4 on an rk3399 (LLLLbb) (i.e. booting with all big CPUs offline): [ 1.422922] Unable to handle kernel paging request at virtual address ffffff8000000000 [ 1.423635] Mem abort info: [ 1.423889] ESR = 0x0000000096000006 [ 1.424227] EC = 0x25: DABT (current EL), IL = 32 bits [ 1.424715] SET = 0, FnV = 0 [ 1.424995] EA = 0, S1PTW = 0 [ 1.425279] FSC = 0x06: level 2 translation fault [ 1.425735] Data abort info: [ 1.425998] ISV = 0, ISS = 0x00000006, ISS2 = 0x00000000 [ 1.426499] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 [ 1.426952] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [ 1.427428] swapper pgtable: 4k pages, 39-bit VAs, pgdp=0000000004a9f000 [ 1.428038] [ffffff8000000000] pgd=18000000f7fff403, p4d=18000000f7fff403, pud=18000000f7fff403, pmd=0000000000000000 [ 1.429014] Internal error: Oops: 0000000096000006 [#1] SMP [ 1.429525] Modules linked in: [ 1.429813] CPU: 3 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.17.0-rc4-dirty #343 PREEMPT [ 1.430559] Hardware name: Pine64 RockPro64 v2.1 (DT) [ 1.431012] pstate: 60000005 (nZC",
    "evidence": "osv:CVE-2025-39895",
    "products": [
      {
        "name": {
          "value": "Kernel",
          "evidence": "/affected/1/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "6.6.105",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.12.46",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.16.6",
            "evidence": "/affected/1/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "medium",
    "structured": {
      "id": "CVE-2025-39895",
      "aliases": [
        "CVE-2025-39895"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "cd7f55359c90a4108e6528e326b8623fce1ad72a"
                },
                {
                  "fixed": "f9b8d4dba8e78c1887fecd81ba0d8204d6ff05fc"
                },
                {
                  "fixed": "b3ec50cc5eb5ca84256ca701d28b137a6036c412"
                },
                {
                  "fixed": "b921c288cd8abef9af5b59e056a63cc2c263a9e3"
                },
                {
                  "fixed": "5ebf512f335053a42482ebff91e46c6dc156bf8c"
                }
              ]
            }
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-39895.json"
          }
        },
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.3.0"
                },
                {
                  "fixed": "6.6.105"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.7.0"
                },
                {
                  "fixed": "6.12.46"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.13.0"
                },
                {
                  "fixed": "6.16.6"
                }
              ]
            }
          ],
          "package": {
            "name": "Kernel",
            "ecosystem": "Linux"
          },
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-39895.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:50.404490533Z",
      "provider": "osv",
      "references": [
        "https://git.kernel.org/stable/c/5ebf512f335053a42482ebff91e46c6dc156bf8c",
        "https://git.kernel.org/stable/c/b3ec50cc5eb5ca84256ca701d28b137a6036c412",
        "https://git.kernel.org/stable/c/b921c288cd8abef9af5b59e056a63cc2c263a9e3",
        "https://git.kernel.org/stable/c/f9b8d4dba8e78c1887fecd81ba0d8204d6ff05fc",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/39xxx/CVE-2025-39895.json",
        "https://nvd.nist.gov/vuln/detail/CVE-2025-39895",
        "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
      ],
      "provider_metadata": {
        "cna_assigner": "Linux",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/39xxx/CVE-2025-39895.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2025-39895",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 519014,
  "published_at": "2025-10-01T07:42:43.92+00:00"
}