CVE-2025-39736
BaseFortify
Publication date: 2025-09-11
Last updated on: 2025-11-03
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | kernel | 5.10.244-1 |
| linux | kernel | 6.1.153-1 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a deadlock issue in the Linux kernel's memory leak detection subsystem (kmemleak). When netpoll is enabled, calling pr_warn_once() while holding the kmemleak_lock in mem_pool_alloc() can cause a deadlock due to lock inversion with the netconsole subsystem. Essentially, pr_warn_once() may trigger netpoll, which leads to a chain of calls that attempt to reacquire the already held kmemleak_lock, causing the system to hang. The fix involves moving the pr_warn_once() call outside the locked section to avoid this deadlock.
How can this vulnerability impact me? :
This vulnerability can cause the Linux kernel to deadlock (hang) when certain memory allocation warnings are triggered while netpoll is enabled. This can lead to system instability or unresponsiveness, potentially affecting system availability and reliability.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, update the Linux kernel to a version where the fix has been applied. The fix involves moving the pr_warn_once() call outside the kmemleak_lock to avoid deadlock. Ensuring that your system is running a patched kernel version will prevent this deadlock issue.