Kernel Oops on CM5: cpu_switch_to write to read-only memory under load (6.12.75+rpt-rpi-2712) #7283
Description
Describe the bug
Description:
The system crashes reproducibly under memory load with a kernel Oops. The error occurs in the CPU scheduler during a context switch (cpu_switch_to). The system becomes completely unresponsive and requires a hard reset.
Unable to handle kernel write to read-only memory at virtual address ffffd06fcf1c80bc
Internal error: Oops: 000000009600004f [#1] PREEMPT SMP
CPU: 1 UID: 0 PID: 60 Comm: kworker/u18:1 Not tainted 6.12.75+rpt-rpi-2712 #1 Debian 1:6.12.75-1+rpt1~bookworm
Hardware name: Raspberry Pi Compute Module 5 Rev 1.0 (DT)
Call trace:
cpu_switch_to+0x18/0x80
__schedule+0x394/0xb60
schedule+0x3c/0x148
worker_thread+0xcc/0x318
kthread+0x11c/0x128
ret_from_fork+0x10/0x20
Steps to reproduce the behaviour
Fresh install of Raspberry Pi OS Bookworm Lite 64-bit
Run: sudo memtester 512M 5
System crashes within a few minutes
Expected behavior:
memtester completes without errors.
Actual behavior:
Kernel Oops with the following error:
Device (s)
Raspberry Pi CM5
System
Hardware:
Raspberry Pi Compute Module 5 Rev 1.0 (8GB RAM, 32GB eMMC)
Carrier board: Waveshare CM5-PoE-BASE-A
Power supply: USB-C 3A
Software:
OS: Raspberry Pi OS Bookworm Lite 64-bit
Kernel: 6.12.75+rpt-rpi-2712 #1 Debian 1:6.12.75-1+rpt1~bookworm
Logs
ar 21 14:15:58 cm5 beszel-agent[751]: 2026/03/21 14:15:58 INFO Starting SSH server addr=:45876 network=tcp
Mar 21 14:16:03 cm5 beszel-agent[751]: 2026/03/21 14:16:03 INFO SSH connected addr=192.168.1.79:48844
Mar 21 14:16:03 cm5 beszel-agent[751]: 2026/03/21 14:16:03 INFO SSH connection established
Mar 21 14:16:03 cm5 sshd[956]: Accepted password for oeme from 192.168.1.2 port 38194 ssh2
Mar 21 14:16:03 cm5 sshd[956]: pam_unix(sshd:session): session opened for user oeme(uid=1000) by (uid=0)
Mar 21 14:16:03 cm5 systemd[1]: Created slice user-1000.slice - User Slice of UID 1000.
Mar 21 14:16:03 cm5 systemd[1]: Starting user-runtime-dir@1000.service - User Runtime Directory /run/user/1000...
Mar 21 14:16:03 cm5 systemd-logind[596]: New session 3 of user oeme.
Mar 21 14:16:03 cm5 systemd[1]: Finished user-runtime-dir@1000.service - User Runtime Directory /run/user/1000.
Mar 21 14:16:03 cm5 systemd[1]: Starting user@1000.service - User Manager for UID 1000...
Mar 21 14:16:03 cm5 (systemd)[1054]: pam_unix(systemd-user:session): session opened for user oeme(uid=1000) by (uid=0)
Mar 21 14:16:03 cm5 systemd[1054]: Queued start job for default target default.target.
Mar 21 14:16:03 cm5 systemd[1054]: Created slice app.slice - User Application Slice.
Mar 21 14:16:03 cm5 systemd[1054]: Reached target paths.target - Paths.
Mar 21 14:16:03 cm5 systemd[1054]: Reached target timers.target - Timers.
Mar 21 14:16:03 cm5 systemd[1054]: Starting dbus.socket - D-Bus User Message Bus Socket...
Mar 21 14:16:03 cm5 systemd[1054]: Listening on dirmngr.socket - GnuPG network certificate management daemon.
Mar 21 14:16:03 cm5 systemd[1054]: Listening on gpg-agent-browser.socket - GnuPG cryptographic agent and passphrase cache (access for web browsers).
Mar 21 14:16:03 cm5 systemd[1054]: Listening on gpg-agent-extra.socket - GnuPG cryptographic agent and passphrase cache (restricted).
Mar 21 14:16:03 cm5 systemd[1054]: Listening on gpg-agent-ssh.socket - GnuPG cryptographic agent (ssh-agent emulation).
Mar 21 14:16:03 cm5 systemd[1054]: Listening on gpg-agent.socket - GnuPG cryptographic agent and passphrase cache.
Mar 21 14:16:03 cm5 systemd[1054]: Listening on dbus.socket - D-Bus User Message Bus Socket.
Mar 21 14:16:03 cm5 systemd[1054]: Reached target sockets.target - Sockets.
Mar 21 14:16:03 cm5 systemd[1054]: Reached target basic.target - Basic System.
Mar 21 14:16:03 cm5 systemd[1054]: Reached target default.target - Main User Target.
Mar 21 14:16:03 cm5 systemd[1054]: Startup finished in 124ms.
Mar 21 14:16:03 cm5 systemd[1]: Started user@1000.service - User Manager for UID 1000.
Mar 21 14:16:03 cm5 systemd[1]: Started session-3.scope - Session 3 of User oeme.
Mar 21 14:16:03 cm5 sshd[956]: pam_env(sshd:session): deprecated reading of user environment enabled
Mar 21 14:16:08 cm5 systemd[1]: NetworkManager-dispatcher.service: Deactivated successfully.
Mar 21 14:16:21 cm5 systemd[1]: systemd-fsckd.service: Deactivated successfully.
Mar 21 14:16:23 cm5 systemd-timesyncd[564]: Contacted time server 134.60.1.27:123 (2.debian.pool.ntp.org).
Mar 21 14:16:23 cm5 systemd-timesyncd[564]: Initial clock synchronization to Sat 2026-03-21 14:16:23.163240 GMT.
Mar 21 14:16:23 cm5 systemd[1]: systemd-hostnamed.service: Deactivated successfully.
Mar 21 14:16:25 cm5 CRON[590]: pam_unix(cron:session): session closed for user root
Mar 21 14:16:40 cm5 sudo[1180]: oeme : TTY=pts/0 ; PWD=/home/oeme ; USER=root ; COMMAND=/usr/bin/journalctl -b -1 --no-pager
Mar 21 14:16:40 cm5 sudo[1180]: pam_unix(sudo:session): session opened for user root(uid=0) by oeme(uid=1000)
Mar 21 14:16:40 cm5 sudo[1180]: pam_unix(sudo:session): session closed for user root
Mar 21 14:17:01 cm5 CRON[1184]: pam_unix(cron:session): session opened for user root(uid=0) by (uid=0)
Mar 21 14:17:01 cm5 CRON[1185]: (root) CMD (cd / && run-parts --report /etc/cron.hourly)
Mar 21 14:17:01 cm5 CRON[1184]: pam_unix(cron:session): session closed for user root
Mar 21 14:17:26 cm5 sudo[1192]: oeme : TTY=pts/0 ; PWD=/home/oeme ; USER=root ; COMMAND=/usr/bin/apt update
Mar 21 14:17:26 cm5 sudo[1192]: pam_unix(sudo:session): session opened for user root(uid=0) by oeme(uid=1000)
Mar 21 14:17:28 cm5 sudo[1192]: pam_unix(sudo:session): session closed for user root
Mar 21 14:17:32 cm5 sudo[1535]: oeme : TTY=pts/0 ; PWD=/home/oeme ; USER=root ; COMMAND=/usr/bin/apt upgrade
Mar 21 14:17:32 cm5 sudo[1535]: pam_unix(sudo:session): session opened for user root(uid=0) by oeme(uid=1000)
Mar 21 14:17:33 cm5 sudo[1535]: pam_unix(sudo:session): session closed for user root
Mar 21 14:17:54 cm5 sudo[1540]: oeme : TTY=pts/0 ; PWD=/home/oeme ; USER=root ; COMMAND=/usr/sbin/memtester 512M 5
Mar 21 14:17:54 cm5 sudo[1540]: pam_unix(sudo:session): session opened for user root(uid=0) by oeme(uid=1000)
Mar 21 14:18:00 cm5 kernel: Unable to handle kernel write to read-only memory at virtual address ffffd06fcf1c80bc
Mar 21 14:18:00 cm5 kernel: Mem abort info:
Mar 21 14:18:00 cm5 kernel: ESR = 0x000000009600004f
Mar 21 14:18:00 cm5 kernel: EC = 0x25: DABT (current EL), IL = 32 bits
Mar 21 14:18:00 cm5 kernel: SET = 0, FnV = 0
Mar 21 14:18:00 cm5 kernel: EA = 0, S1PTW = 0
Mar 21 14:18:00 cm5 kernel: FSC = 0x0f: level 3 permission fault
Mar 21 14:18:00 cm5 kernel: Data abort info:
Mar 21 14:18:00 cm5 kernel: ISV = 0, ISS = 0x0000004f, ISS2 = 0x00000000
Mar 21 14:18:00 cm5 kernel: CM = 0, WnR = 1, TnD = 0, TagAccess = 0
Mar 21 14:18:00 cm5 kernel: GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
Mar 21 14:18:00 cm5 kernel: swapper pgtable: 16k pages, 47-bit VAs, pgdp=00000000014e0000
Mar 21 14:18:00 cm5 kernel: [ffffd06fcf1c80bc] pgd=1000000001d8c003, p4d=1000000001d8c003, pud=1000000001d8c003, pmd=1000000001d90003, pte=0040000000fc8f83
Mar 21 14:18:00 cm5 kernel: Internal error: Oops: 000000009600004f [#1] PREEMPT SMP
Mar 21 14:18:00 cm5 kernel: Modules linked in: nf_conntrack_netlink xfrm_user xfrm_algo br_netfilter bridge stp llc wireguard libchacha20poly1305 chacha_neon poly1305_neon ip6_udp_tunnel udp_tunnel libcurve25519_generic libchacha rfkill overlay binfmt_misc nft_chain_nat xt_MASQUERADE nf_nat xt_addrtype xt_conntrack nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nft_compat spidev nf_tables nfnetlink aes_ce_blk aes_ce_cipher ghash_ce gf128mul libaes sha2_ce sha256_arm64 sha1_ce sha1_generic raspberrypi_hwmon rpi_hevc_dec v4l2_mem2mem pisp_be videobuf2_dma_contig spi_bcm2835 i2c_brcmstb videobuf2_memops gpio_keys videobuf2_v4l2 videodev v3d videobuf2_common gpu_sched mc drm_shmem_helper nvmem_rmem rp1_adc raspberrypi_gpiomem rp1_pio rp1_mailbox rp1_fw fuse dm_mod ip_tables x_tables ipv6 vc4 snd_soc_hdmi_codec snd_soc_core snd_compress snd_pcm_dmaengine snd_pcm snd_timer snd drm_display_helper drm_dma_helper drm_kms_helper drm drm_panel_orientation_quirks backlight cec uio_pdrv_genirq uio
Mar 21 14:18:00 cm5 kernel: CPU: 1 UID: 0 PID: 60 Comm: kworker/u18:1 Not tainted 6.12.75+rpt-rpi-2712 #1 Debian 1:6.12.75-1+rpt1~bookworm
Mar 21 14:18:00 cm5 kernel: Hardware name: Raspberry Pi Compute Module 5 Rev 1.0 (DT)
Mar 21 14:18:00 cm5 kernel: Workqueue: 0x0 (events_unbound)
Mar 21 14:18:00 cm5 kernel: pstate: 604003c9 (nZCv DAIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
Mar 21 14:18:00 cm5 kernel: pc : cpu_switch_to+0x18/0x80
Mar 21 14:18:00 cm5 kernel: lr : __switch_to+0xf0/0x150
Mar 21 14:18:00 cm5 kernel: sp : ffffc0008236bd20
Mar 21 14:18:00 cm5 kernel: x29: ffffc0008236bd20 x28: ffff800002d80000 x27: ffff80003fb69cc0
Mar 21 14:18:00 cm5 kernel: x26: 0000000000000000 x25: ffff800002d80698 x24: 0000000000000402
Mar 21 14:18:00 cm5 kernel: x23: ffffd06fcfc92630 x22: ffffd06fcf1c667c x21: 0000000000000000
Mar 21 14:18:00 cm5 kernel: x20: ffffd06fcf1c667c x19: ffff800003396b00 x18: 0000000000000000
Mar 21 14:18:00 cm5 kernel: x17: 0000000000000000 x16: 0000000000000000 x15: 000055560c4382a0
Mar 21 14:18:00 cm5 kernel: x14: 0000000000000001 x13: 0000000000000000 x12: 0000000000000008
Mar 21 14:18:00 cm5 kernel: x11: 00000000000000c0 x10: 0000000000001a40 x9 : ffffc0008236bd20
Mar 21 14:18:00 cm5 kernel: x8 : ffffd06fcf1c80bc x7 : 0000000000000001 x6 : 0000000000000000
Mar 21 14:18:00 cm5 kernel: x5 : 00000000410fd0b0 x4 : 0000000000f0000f x3 : 0000000000400001
Mar 21 14:18:00 cm5 kernel: x2 : 000000003464d83d x1 : ffff800003396b00 x0 : ffffd06fcf1c667c
Mar 21 14:18:00 cm5 kernel: Call trace:
Mar 21 14:18:00 cm5 kernel: cpu_switch_to+0x18/0x80
Mar 21 14:18:00 cm5 kernel: __schedule+0x394/0xb60
Mar 21 14:18:00 cm5 kernel: schedule+0x3c/0x148
Mar 21 14:18:00 cm5 kernel: worker_thread+0xcc/0x318
Mar 21 14:18:00 cm5 kernel: kthread+0x11c/0x128
Mar 21 14:18:00 cm5 kernel: ret_from_fork+0x10/0x20
Mar 21 14:18:00 cm5 kernel: Code: d5034fdf d283480a 8b0a0008 910003e9 (a8815113)
Additional context
The issue is reproducible across multiple boots
Also observed: segmentation faults in apt under load
EXT4 filesystem requires orphan cleanup after each crash, indicating unclean shutdown
Temperature under load: 60-70°C (no throttling reported by vcgencmd get_throttled)
The crash occurs randomly under load, not at a fixed point.
Sometimes memtester runs for several minutes before crashing,
sometimes it crashes almost immediately.