LiveActive security incident?Get immediate response
CVE Record

CVE-2025-71119: powerpc/kexec: Enable SMT before waking offline CPUs

In the Linux kernel, the following vulnerability has been resolved: powerpc/kexec: Enable SMT before waking offline CPUs If SMT is disabled or a partial SMT state is enabled, when a new kernel image is loaded for kexec, on reboot the following warning is observed: kexec: Waking offline cpu 228. WARNING: CPU: 0 PID: 9062 at arch/powerpc/kexec/core_64.c:223 kexec_prepare_cpus+0x1b0/0x1bc [snip] NIP kexec_prepare_cpus+0x1b0/0x1bc LR kexec_prepare_cpus+0x1a0/0x1bc Call Trace: kexec_prepare_cpus+0x1a0/0x1bc (unreliable) default_machine_kexec+0x160/0x19c machine_kexec+0x80/0x88 kernel_kexec+0xd0/0x118 __do_sys_reboot+0x210/0x2c4 system_call_exception+0x124/0x320 system_call_vectored_common+0x15c/0x2ec This occurs as add_cpu() fails due to cpu_bootable() returning false for CPUs that fail the cpu_smt_thread_allowed() check or non primary threads if SMT is disabled. Fix the issue by enabling SMT and resetting the number of SMT threads to the number of threads per core, before attempting to wake up all present CPUs.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This is a Linux kernel reliability bug on PowerPC systems using kexec. When simultaneous multithreading is disabled or partially enabled, a kexec reboot can fail to wake some offline CPUs and trigger a kernel warning. The public record does not describe remote compromise, privilege escalation, or data exposure.

Executive priority

Treat this as a targeted operational reliability issue, not a broad emergency. Patch during normal kernel maintenance unless PowerPC kexec reboot reliability is critical to recovery, high availability, or incident response processes.

Technical view

In the PowerPC kexec path, add_cpu() can fail because cpu_bootable() rejects CPUs blocked by cpu_smt_thread_allowed() or non-primary threads when SMT is disabled. The fix enables SMT and restores the thread count per core before waking all present CPUs during kexec preparation.

Likely exposure

Exposure appears limited to Linux on PowerPC systems running affected kernel versions and using kexec, especially where SMT is disabled or in a partial SMT state. Organizations without PowerPC fleets or kexec-based reboot workflows are unlikely to be affected based on the supplied sources.

Exploitation context

The supplied sources do not report active exploitation, public exploit code, KEV listing, or attacker-controlled exploitation. The described impact is operational: warnings or CPU wake failures during kexec reboot handling under specific SMT conditions.

Researcher notes

Evidence is narrow and kernel-specific. The source bundle provides affected Linux version data and stable commit references but no CVSS, CWE, exploitability analysis, or distribution-specific fixed package versions. Validate against vendor advisories before assigning enterprise severity.

Mitigation direction

  • Apply vendor kernel updates that include the referenced stable fixes.
  • Prioritize PowerPC systems that use kexec-based reboot or crash workflows.
  • Until patched, avoid kexec reboots with disabled or partial SMT where operationally feasible.
  • Check Linux distribution advisories for packaged kernel availability and support guidance.

Validation and detection

  • Inventory PowerPC Linux hosts and record kernel versions.
  • Identify systems using kexec, crash kernels, or fast reboot workflows.
  • Review SMT configuration for disabled or partial SMT states.
  • After updating, test kexec reboot behavior in staging.
  • Check kernel logs for the documented kexec_prepare_cpus warning.
Prepared
Confidence
medium
Sources
7

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-71119 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
6Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux482fa21635c8832db022cd2d649db26b8e6170ac, 38253464bc821d6de6bba81bb1412ebb36f6cbd1, 38253464bc821d6de6bba81bb1412ebb36f6cbd1, 38253464bc821d6de6bba81bb1412ebb36f6cbd1, 38253464bc821d6de6bba81bb1412ebb36f6cbd1, 15141adf85b14a7cff7abba1cb983f0bf17e3b36, 6.1.72, 6.5.12unaffected
LinuxLinux6.6, 0, 6.1.160, 6.6.120, 6.12.64, 6.18.3, 6.19affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.