CVE-2025-39910

What it actually does

The flaw causes kasan_populate_vmalloc to ignore the caller-provided GFP mask when allocating shadow memory for vmalloc regions, potentially using incorrect allocation flags that violate caller constraints in low-memory or restricted-allocation contexts.

Why it matters to the business

Systems may experience unexpected memory allocation failures, kernel panics, or silent corruption of virtual memory mappings, leading to reduced stability and availability especially on long-running servers or embedded devices using KASAN-enabled kernels.

How an attack unfolds

An attacker would need to trigger vmalloc allocations under specific GFP constraints while KASAN is active; because the mask is not respected, the allocation may fail or behave unexpectedly, but no public exploits or threat actor campaigns are known for this issue.

How to fix it

Update to a kernel containing commit 33b95d90427cb4babf32059e323a6d0c027610fe or apply the SUSE package openssl 1.0.2j-60.30.1 (or later) where the fix has been backported.

How to confirm the fix worked

Confirm the running kernel includes the cited commit hash or the listed SUSE package version; review kernel build configuration to ensure KASAN is active and test vmalloc paths under constrained GFP masks.

Typical attack path

1. Identify a code path that performs vmalloc under restricted GFP flags with KASAN enabled
2. Trigger repeated allocations to exhaust or stress the vmalloc area
3. Observe resulting allocation failures or kernel instability

How to detect it

Examine kernel logs for allocation-related warnings or panics around vmalloc/KASAN paths; no confirmed post-exploitation artifacts exist due to absence from KEV and lack of known campaigns.

What your security team should do

• Prioritize patching production kernels that enable KASAN within the next maintenance window
• Monitor EPSS trend for any continued rise despite current low score
• Review downstream package dependencies for additional affected distributions