You have been subscribed to a public bug:
================================================================
BUG REPORT: Kernel panic - UBSAN array-index-out-of-bounds in
qspinlock during NOHZ idle balance (kernel 7.0.0-28/-29)
================================================================
PACKAGE: linux (Ubuntu 26.04 LTS "resolute")
AFFECTED KERNELS: 7.0.0-28-generic AND 7.0.0-29-generic (both affected)
HARDWARE: Intel NUC7i7BNH (NUC7i7BNB, BIOS BNKBL357.86A.0080.2019.0725.1139)
CPU: 4 cores (0-3), i7-7567U
SEVERITY: HIGH - machine panics and reboots every 1-7 days, at idle/low load
----------------------------------------------------------------
SUMMARY
----------------------------------------------------------------
The machine dies periodically (1-7 day intervals, usually at idle,
often at night). EFI pstore dumps captured on 4 separate occasions
all show the IDENTICAL kernel panic:
UBSAN: array-index-out-of-bounds in
/build/linux-7.0.0/kernel/locking/qspinlock.h:68:9
index -1 is out of range for type 'long unsigned int [8192]'
--> BUG: unable to handle page fault
--> Oops: 0002 [#1] SMP PTI
--> RIP: native_queued_spin_lock_slowpath+0x2f5/0x370
--> Kernel panic - not syncing: Fatal exception in interrupt
The panic occurs in the NOHZ idle-balance path of the scheduler,
in interrupt context, on an idle CPU (swapper/N, do_idle).
----------------------------------------------------------------
FULL CALL TRACE (identical across all 4 panics)
----------------------------------------------------------------
native_queued_spin_lock_slowpath+0x350/0x370
_raw_spin_lock+0x3f/0x60
raw_spin_rq_lock_nested+0x21/0xa0
_raw_spin_rq_lock_irqsave+0x21/0x40
sched_balance_update_blocked_averages+0x33/0xc0
_nohz_idle_balance.isra.0+0x345/0x3c0
sched_balance_softirq+0x6b/0x80
handle_softirqs+0xe1/0x360
__do_softirq+0x10/0x18
do_softirq.part.0+0x3f/0x80
do_softirq+0x1a/0x30
flush_smp_call_function_queue+0x66/0x80
do_idle+0xb1/0xf0
cpu_startup_entry+0x29/0x30
start_secondary+0x125/0x180
Oops registers (one example, 7.0.0-29, uptime 73911s):
RIP: 0010:native_queued_spin_lock_slowpath+0x2f5/0x370
RAX: ffffffffaea35520 RBX: ffff8baadedb3380 RCX: ffff8baadedb33c8
RDX: ffff8baaded34500 RSI: ffffffffffffffff RDI: 0000000000000000
CR2: ffffffffaea35520
#PF: supervisor write access in kernel mode
#PF: error_code(0x0002) - not-present page
----------------------------------------------------------------
EVIDENCE (all 4 pstore dumps, archived by systemd-pstore)
----------------------------------------------------------------
Archive dir Uptime at panic Kernel Death date
1785408010/001 203228s (~2.4d) 7.0.0-28 before 2026-08-01
1786160228/001 614878s (~7.1d) 7.0.0-28 2026-08-08 06:30
1786382890/001 161268s (~1.9d) 7.0.0-29 2026-08-10 20:24
1786491908/002 73911s (~20.5h) 7.0.0-29 2026-08-12 02:45
UBSAN reports (identical in every dump):
[161268.205716] UBSAN: array-index-out-of-bounds in
/build/linux-zi5WOl/linux-7.0.0/kernel/locking/qspinlock.h:68:9
[203228.433623] UBSAN: array-index-out-of-bounds in
/build/linux-LJ62VM/linux-7.0.0/kernel/locking/qspinlock.h:68:9
[614878.653117] UBSAN: array-index-out-of-bounds in
/build/linux-LJ62VM/linux-7.0.0/kernel/locking/qspinlock.h:68:9
[73911.594789] UBSAN: array-index-out-of-bounds in
/build/linux-zi5WOl/linux-7.0.0/kernel/locking/qspinlock.h:68:9
Kernel panics:
[203228.594959] Kernel panic - not syncing: Attempted to kill the idle task!
[614878.787318] Kernel panic - not syncing: Fatal exception in interrupt
[161268.325194] Kernel panic - not syncing: Fatal exception in interrupt
[73911.776156] Kernel panic - not syncing: Fatal exception in interrupt
----------------------------------------------------------------
SYSTEM
----------------------------------------------------------------
Distributor: Ubuntu 26.04 LTS (resolute)
uname: Linux dc-test2 7.0.0-29-generic #29-Ubuntu SMP PREEMPT_DYNAMIC
Fri Jul 17 20:52:35 UTC 2026 x86_64 GNU/Linux
Installed kernels: 7.0.0-14, 7.0.0-27, 7.0.0-28, 7.0.0-29
No hardware errors anywhere: no MCE, no thermal, no memory errors.
System is otherwise healthy; deaths are 100% software (kernel panic).
----------------------------------------------------------------
NOTES
----------------------------------------------------------------
- The btop snap AppArmor DENIED spam in the journal is unrelated
noise (btop snap profile denies reading /sys/fs/cgroup files).
The kernel panic is in scheduler softirq context and is the
sole cause of the deaths.
- The kernel at panic is "Not tainted" (stock Ubuntu kernel,
no proprietary modules).
- qspinlock.h:68 indexes a per-CPU array with index -1; with
CONFIG_NR_CPUS=8192 the array is 'long unsigned int [8192]'.
- Both affected kernels: 7.0.0-28-generic and 7.0.0-29-generic.
- Full pstore dumps attached (pstore-dump.txt, system-info.txt).
** Affects: ubuntu
Importance: Undecided
Status: New
** Tags: nohz
--
The machine dies periodically (1-7 day intervals, usually at idle, often at
night). EFI pstore dumps captured on 4 separate occasions all show the
IDENTICAL kernel panic
https://bugs.launchpad.net/bugs/2163292
You received this bug notification because you are a member of Ubuntu Bugs,
which is subscribed to Ubuntu.
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
