CVE-2025-38510
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-08-16

Last updated on: 2025-11-03

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: kasan: remove kasan_find_vm_area() to prevent possible deadlock find_vm_area() couldn't be called in atomic_context. If find_vm_area() is called to reports vm area information, kasan can trigger deadlock like: CPU0 CPU1 vmalloc(); alloc_vmap_area(); spin_lock(&vn->busy.lock) spin_lock_bh(&some_lock); <interrupt occurs> <in softirq> spin_lock(&some_lock); <access invalid address> kasan_report(); print_report(); print_address_description(); kasan_find_vm_area(); find_vm_area(); spin_lock(&vn->busy.lock) // deadlock! To prevent possible deadlock while kasan reports, remove kasan_find_vm_area().
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-08-16
Last Modified
2025-11-03
Generated
2026-05-27
AI Q&A
2025-08-16
EPSS Evaluated
2026-05-25
NVD
CVE-2025-38510
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel 6.1.153
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

This vulnerability involves a potential deadlock in the Linux kernel's Kernel Address Sanitizer (kasan) subsystem. Specifically, the function kasan_find_vm_area() calls find_vm_area(), which cannot be safely called in atomic context. When kasan reports an invalid memory access, it may trigger a deadlock due to nested spin_lock calls on the same lock from different CPUs or interrupt contexts. To fix this, kasan_find_vm_area() was removed to prevent the deadlock scenario.


How can this vulnerability impact me? :

This vulnerability can cause the Linux kernel to deadlock when kasan attempts to report invalid memory accesses. A deadlock in the kernel can lead to system hangs or crashes, impacting system stability and availability.


What immediate steps should I take to mitigate this vulnerability?

To mitigate this vulnerability, update the Linux kernel to a version where kasan_find_vm_area() has been removed to prevent the possible deadlock. Avoid using kernel versions that include the vulnerable kasan_find_vm_area() function.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart