CVE-2025-39736

Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
11/09/2025
Last modified:
09/01/2026

Description

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> mm/kmemleak: avoid deadlock by moving pr_warn() outside kmemleak_lock<br /> <br /> When netpoll is enabled, calling pr_warn_once() while holding<br /> kmemleak_lock in mem_pool_alloc() can cause a deadlock due to lock<br /> inversion with the netconsole subsystem. This occurs because<br /> pr_warn_once() may trigger netpoll, which eventually leads to<br /> __alloc_skb() and back into kmemleak code, attempting to reacquire<br /> kmemleak_lock.<br /> <br /> This is the path for the deadlock.<br /> <br /> mem_pool_alloc()<br /> -&gt; raw_spin_lock_irqsave(&amp;kmemleak_lock, flags);<br /> -&gt; pr_warn_once()<br /> -&gt; netconsole subsystem<br /> -&gt; netpoll<br /> -&gt; __alloc_skb<br /> -&gt; __create_object<br /> -&gt; raw_spin_lock_irqsave(&amp;kmemleak_lock, flags);<br /> <br /> Fix this by setting a flag and issuing the pr_warn_once() after<br /> kmemleak_lock is released.

Vulnerable products and versions

CPE From Up to
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 5.4 (including) 5.4.297 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 5.5 (including) 5.10.241 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 5.11 (including) 5.15.190 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 5.16 (including) 6.1.149 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 6.2 (including) 6.6.103 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 6.7 (including) 6.12.43 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 6.13 (including) 6.15.11 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 6.16 (including) 6.16.2 (excluding)
cpe:2.3:o:linux:linux_kernel:6.17:rc1:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*