CVE-2025-38029
Medium · 5.5CVSS
5.5
EPSS
0.2%
Published
Jun 18, 2025
CISA due date
—
Cloudanix analysis
A bug in the Linux kernel can make the system crash when creating new processes on certain hardware, so updating to a newer kernel version prevents the crash.
- Exploitation
- Other
- Attacker needs
- Local User
- Complexity
- Moderate
- Impact
- Denial Of Service
- Component
- OS kernel
- Class
- Race Condition
- Remediation
- Upgrade
- Effort
- Medium
- Patch risk
- Low
What it actually does
Triggers a kernel BUG when KASAN's kasan_populate_vmalloc_pte attempts a sleepable page allocation while apply_to_pte_range holds lazy MMU mode with preemption disabled on architectures such as s390.
Why it matters to the business
Causes immediate kernel panic during thread creation and vmalloc operations on affected stable kernels, leading to denial of service and requiring emergency reboots or rollbacks until patched kernels are deployed.
How an attack unfolds
An attacker or benign workload triggers kernel_clone or __vmalloc_node operations that walk page tables under lazy MMU; on s390 the preemption state causes the subsequent single-page allocation inside KASAN to sleep, hitting the sleeping-function-from-atomic-context check.
How to fix it
Upgrade to a kernel containing commit 6748dd09196248b985cca39eaf651d5317271977 which bulk-allocates shadow memory before the page-table walk; apply the matching stable or distribution update that back-ports this change.
How to confirm the fix worked
Confirm the running kernel git commit or package version contains 6748dd09196248b985cca39eaf651d5317271977; reproduce thread creation under KASAN on s390 and verify absence of the sleeping-function BUG; monitor dmesg for the prior crash signature.
Typical attack path
- Trigger thread creation or vmalloc-heavy workload
- Enter apply_to_pte_range under lazy MMU mode
- Invoke kasan_populate_vmalloc_pte which calls alloc_pages
- Architecture disables preemption, violating atomic context rules
- Kernel hits BUG and panics
How to detect it
Search kernel logs for the exact BUG string "sleeping function called from invalid context" together with the stack trace containing kasan_populate_vmalloc_pte and apply_to_pte_range; correlate with kthreadd or kernel_thread activity on s390 systems.
- BUG: sleeping function called from invalid context at ./include/linux/sched/mm.h:321
- kasan_populate_vmalloc_pte+0x50/0x120
- apply_to_pte_range+0x118/0x4a0
- kthreadd/2
What your security team should do
- Prioritize kernel updates containing the referenced commit on all s390 and other affected architectures
- Reboot affected systems after package installation to load the fixed kernel
- Temporarily disable KASAN on non-production s390 systems if immediate patching is delayed
The record
In the Linux kernel, the following vulnerability has been resolved: kasan: avoid sleepable page allocation from atomic context apply_to_pte_range() enters the lazy MMU mode and then invokes kasan_populate_vmalloc_pte() callback on each page table walk iteration. However, the callback can go into sleep when trying to allocate a single page, e.g. if an architecutre disables preemption on lazy MMU mode enter. On s390 if make arch_enter_lazy_mmu_mode() -> preempt_enable() and arch_leave_lazy_mmu_mode() -> preempt_disable(), such crash occurs: [ 0.663336] BUG: sleeping function called from invalid context at ./include/linux/sched/mm.h:321 [ 0.663348] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 2, name: kthreadd [ 0.663358] preempt_count: 1, expected: 0 [ 0.663366] RCU nest depth: 0, expected: 0 [ 0.663375] no locks held by kthreadd/2. [ 0.663383] Preemption disabled at: [ 0.663386] [<0002f3284cbb4eda>] apply_to_pte_range+0xfa/0x4a0 [ 0.663405] CPU: 0 UID: 0 PID: 2 Comm: kthreadd Not tainted 6.15.0-rc5-gcc-kasan-00043-gd76bb1ebb558-dirty #162 PREEMPT [ 0.663408] Hardware name: IBM 3931 A01 701 (KVM/Linux) [ 0.663409] Call Trace: [ 0.663410] [<0002f3284c385f58>] dump_stack_lvl+0xe8/0x140 [ 0.663413] [<0002f3284c507b9e>] __might_resched+0x66e/0x700 [ 0.663415] [<0002f3284cc4f6c0>] __alloc_frozen_pages_noprof+0x370/0x4b0 [ 0.663419] [<0002f3284ccc73c0>] alloc_pages_mpol+0x1a0/0x4a0 [ 0.663421] [<0002f3284ccc8518>] alloc_frozen_pages_noprof+0x88/0xc0 [ 0.663424] [<0002f3284ccc8572>] alloc_pages_noprof+0x22/0x120 [ 0.663427] [<0002f3284cc341ac>] get_free_pages_noprof+0x2c/0xc0 [ 0.663429] [<0002f3284cceba70>] kasan_populate_vmalloc_pte+0x50/0x120 [ 0.663433] [<0002f3284cbb4ef8>] apply_to_pte_range+0x118/0x4a0 [ 0.663435] [<0002f3284cbc7c14>] apply_to_pmd_range+0x194/0x3e0 [ 0.663437] [<0002f3284cbc99be>] __apply_to_page_range+0x2fe/0x7a0 [ 0.663440] [<0002f3284cbc9e88>] apply_to_page_range+0x28/0x40 [ 0.663442] [<0002f3284ccebf12>] kasan_populate_vmalloc+0x82/0xa0 [ 0.663445] [<0002f3284cc1578c>] alloc_vmap_area+0x34c/0xc10 [ 0.663448] [<0002f3284cc1c2a6>] __get_vm_area_node+0x186/0x2a0 [ 0.663451] [<0002f3284cc1e696>] __vmalloc_node_range_noprof+0x116/0x310 [ 0.663454] [<0002f3284cc1d950>] __vmalloc_node_noprof+0xd0/0x110 [ 0.663457] [<0002f3284c454b88>] alloc_thread_stack_node+0xf8/0x330 [ 0.663460] [<0002f3284c458d56>] dup_task_struct+0x66/0x4d0 [ 0.663463] [<0002f3284c45be90>] copy_process+0x280/0x4b90 [ 0.663465] [<0002f3284c460940>] kernel_clone+0xd0/0x4b0 [ 0.663467] [<0002f3284c46115e>] kernel_thread+0xbe/0xe0 [ 0.663469] [<0002f3284c4e440e>] kthreadd+0x50e/0x7f0 [ 0.663472] [<0002f3284c38c04a>] __ret_from_fork+0x8a/0xf0 [ 0.663475] [<0002f3284ed57ff2>] ret_from_fork+0xa/0x38 Instead of allocating single pages per-PTE, bulk-allocate the shadow memory prior to applying kasan_populate_vmalloc_pte() callback on a page range.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Chainguard | hyperv-daemons-6.12 | 0 | 6.12.57-r2 |
| Chainguard | linux-aws-6.12-boot-installed | 0 | 6.12.57-r2 |
| Chainguard | linux-aws-6.12-fips-boot-installed | 0 | 6.12.57-r2 |
| Chainguard | linux-aws-6.12-headers | 0 | 6.12.57-r2 |
| Chainguard | linux-aws-6.12-modules | 0 | 6.12.57-r2 |
| Chainguard | linux-azure-6.12-boot-installed | 0 | 6.12.57-r2 |
| Chainguard | linux-azure-6.12-fips-boot-installed | 0 | 6.12.57-r2 |
| Chainguard | linux-azure-6.12-headers | 0 | 6.12.57-r2 |
| Chainguard | linux-azure-6.12-modules | 0 | 6.12.57-r2 |
| Chainguard | linux-gcp-6.12-boot-installed | 0 | 6.12.58-r0 |
| Chainguard | linux-gcp-6.12-fips-boot-installed | 0 | 6.12.57-r2 |
| Chainguard | linux-gcp-6.12-headers | 0 | 6.12.57-r2 |
| Chainguard | linux-gcp-6.12-modules | 0 | 6.12.57-r2 |
| Chainguard | linux-qemu-6.12-boot-installed | 0 | 6.12.63-r0 |
| Chainguard | linux-qemu-6.12-fips-boot-installed | 0 | 6.12.63-r0 |
| Chainguard | linux-qemu-6.12-headers | 0 | 6.12.63-r0 |
| Chainguard | linux-qemu-6.12-modules | 0 | 6.12.63-r0 |
| Chainguard | linux-vmware-6.12-boot-installed | 0 | 6.12.63-r0 |
| Chainguard | linux-vmware-6.12-fips-boot-installed | 0 | 6.12.63-r0 |
| Chainguard | linux-vmware-6.12-headers | 0 | 6.12.63-r0 |
| Chainguard | linux-vmware-6.12-modules | 0 | 6.12.63-r0 |
| Debian:11 | linux | 0 | No fix |
| Debian:12 | linux | 0 | No fix |
| Debian:13 | linux | 0 | No fix |
| Debian:14 | linux | 0 | 6.16.3-1 |
| Linux | Kernel | 5.5.0 | 6.14.9 |
Related vulnerabilities
- CVE-2025-39910 In the Linux kernel, the following vulnerability has been resolved: mm/vmalloc, mm/kasan… Also affects hyperv-daemons-6.12
- CVE-2025-39925 can: j1939: implement NETDEV_UNREGISTER notification handler Also affects hyperv-daemons-6.12
- CVE-2025-39905 net: phylink: add lock for serializing concurrent pl->phydev writes with resolver Also affects hyperv-daemons-6.12
- CVE-2025-39862 In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915… Also affects hyperv-daemons-6.12
- CVE-2025-39859 In the Linux kernel, the following vulnerability has been resolved: ptp: ocp: fix… Also affects hyperv-daemons-6.12
- CVE-2025-39834 In the Linux kernel, the following vulnerability has been resolved: net/mlx5: HWS, Fix… Also affects hyperv-daemons-6.12
- CVE-2025-39830 In the Linux kernel, the following vulnerability has been resolved: net/mlx5: HWS, Fix… Also affects hyperv-daemons-6.12
- CVE-2025-39833 In the Linux kernel, the following vulnerability has been resolved: mISDN: hfcpci: Fix… Also affects hyperv-daemons-6.12