Cloudanix VulnDB

CVE-2025-39736

Medium · 5.5

CVSS

5.5

EPSS

0.1%

Published

Sep 11, 2025

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in Linux memory tracking can freeze systems when network logging features are active, requiring software updates to prevent potential outages.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Race Condition
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Deadlock in kmemleak memory tracking code when pr_warn_once() is invoked while holding kmemleak_lock under netpoll-enabled configurations, due to lock inversion with netconsole leading to recursive allocation attempts.

Why it matters to the business

Linux systems using netconsole or similar netpoll features may experience hangs or reduced availability during memory allocation paths, with potential for local denial of service; the issue affects kernel-based environments including certain downstream package ecosystems.

How an attack unfolds

An attacker with local access triggers mem_pool_alloc() under netpoll conditions to acquire kmemleak_lock, then forces a warning path that invokes netconsole, __alloc_skb, and re-entry into kmemleak code, resulting in deadlock; no known threat actors or ransomware campaigns have exploited this.

How to fix it

Update to fixed kernel versions containing commit c7b6ea0ede687e7460e593c5ea478f50aa41682a or later; for affected packages apply git-lfs (Chainguard) 3.7.0-r2, git-lfs (Wolfi) 3.7.0-r2, git-lfs-config (Chainguard) 3.7.0-r2, or git-lfs-config (Wolfi) 3.7.0-r2.

How to confirm the fix worked

Confirm kernel source includes the referenced commit or package versions match the listed fixed releases; test netconsole-enabled workloads for absence of deadlock on allocation warnings.

Typical attack path

  1. Obtain local code execution on affected Linux kernel
  2. Enable or ensure netpoll/netconsole subsystem is active
  3. Trigger memory allocation path that calls mem_pool_alloc()
  4. Cause pr_warn_once() while kmemleak_lock is held
  5. Induce recursive allocation via netconsole leading to deadlock

How to detect it

Review kernel logs and netconsole traces for repeated allocation warnings coinciding with system hangs; examine dmesg or syslog for kmemleak_lock related entries post-netpoll activity.

What your security team should do

  • Prioritize kernel and git-lfs package upgrades within maintenance windows due to local availability impact
  • Review netconsole configurations for necessity and disable where possible until patched
  • Monitor for future EPSS increases given the 411 days since publication

The record

In the Linux kernel, the following vulnerability has been resolved: mm/kmemleak: avoid deadlock by moving pr_warn() outside kmemleak_lock When netpoll is enabled, calling pr_warn_once() while holding kmemleak_lock in mem_pool_alloc() can cause a deadlock due to lock inversion with the netconsole subsystem. This occurs because pr_warn_once() may trigger netpoll, which eventually leads to __alloc_skb() and back into kmemleak code, attempting to reacquire kmemleak_lock. This is the path for the deadlock. mem_pool_alloc() -> raw_spin_lock_irqsave(&kmemleak_lock, flags); -> pr_warn_once() -> netconsole subsystem -> netpoll -> __alloc_skb -> __create_object -> raw_spin_lock_irqsave(&kmemleak_lock, flags); Fix this by setting a flag and issuing the pr_warn_once() after kmemleak_lock is released.

Affected packages

Ecosystem Package Introduced Fixed
Debian:11 linux 0 No fix
Debian:12 linux 0 No fix
Debian:13 linux 0 6.12.43-1
Debian:14 linux 0 6.16.3-1
Linux Kernel 5.4.0 5.4.297

Related vulnerabilities