CVE-2025-38510
Description
In the Linux kernel, the following vulnerability has been resolved: kasan: remove kasan_find_vm_area() to prevent possible deadlock find_vm_area() couldn't be called in atomic_context. If find_vm_area() is called to reports vm area information, kasan can trigger deadlock like: CPU0 CPU1 vmalloc(); alloc_vmap_area(); spin_lock(&vn->busy.lock) spin_lock_bh(&some_lock); <interrupt occurs> <in softirq> spin_lock(&some_lock); <access invalid address> kasan_report(); print_report(); print_address_description(); kasan_find_vm_area(); find_vm_area(); spin_lock(&vn->busy.lock) // deadlock! To prevent possible deadlock while kasan reports, remove kasan_find_vm_area().
How to fix
- linux linux_kernel6.1.146, 6.6.99, 6.12.39, 6.15.7 or later
- git.kernel.org/stable/c/0c3566d831def922cd56322c772a7b20d8b0e0c0
- git.kernel.org/stable/c/2d89dab1ea6086e6cbe6fe92531b496fb6808cb9
- git.kernel.org/stable/c/595f78d99b9051600233c0a5c4c47e1097e6ed01
- git.kernel.org/stable/c/6ee9b3d84775944fb8c8a447961cd01274ac671c
- git.kernel.org/stable/c/8377d7744bdce5c4b3f1b58924eebd3fdc078dfc
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| linux linux_kernel | 5.18 ≤ v < 6.1.146, 6.2 ≤ v < 6.6.99, 6.7 ≤ v < 6.12.39, 6.13 ≤ v < 6.15.7, 6.16 | 6.1.146, 6.6.99, 6.12.39, 6.15.7 |
| debian debian_linux | 11.0 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.