The vulnerability occurs when the LoongArch kernel shuts down all CPUs without reporting a dying CPU to RCU. Because RCU expects every CPU to eventually reach a quiescent state, the missing report causes RCU to block waiting for a grace period that can never complete. When shutdown or reboot paths issue an irq_work_sync call after smp_send_stop(), the request stalls on the nonexistent RCU grace period, preventing the system from completing the reboot. The result is a denial‑of‑service condition where the machine hangs during shutdown or reboot. The weakness can be classified as an improper handling of CPU hot‑plug / shutdown synchronization, leading to a deadlock in the RCU subsystem. It does not provide remote code execution or privilege escalation directly, but it does compromise availability. Because the issue requires the system to go through a reboot or shutdown sequence, it is a local or system‑privileged threat; only entities capable of initiating a shutdown can exploit it. The absence of an RCU notification constitutes a logic error in the kernel maintenance path rather than a generic flaw.

Linux kernel on the LoongArch architecture. No specific kernel versions are listed in the data, so the vulnerability applies to all LoongArch builds until a patch that adds rcutree_report_cpu_dead after interrupts are disabled is applied.

The EPSS score is below 1% and the vulnerability is not listed in the CISA KEV catalog, indicating a very low likelihood of widespread exploitation. The CVSS score is 5.5, but the risk is significant to affected installations because an intentional shutdown can hang the system. The vulnerability is local, requiring the ability to initiate system reboot or shutdown, and it is exploitable only in the shutdown/reboot path where RCU grace periods are invoked. The severity is mainly due to the availability impact rather than confidentiality or integrity.