CVE-2025-39843 (GCVE-0-2025-39843)

Vulnerability from cvelistv5 – Published: 2025-09-19 15:26 – Updated: 2025-11-03 17:43
VLAI?
Summary
In the Linux kernel, the following vulnerability has been resolved: mm: slub: avoid wake up kswapd in set_track_prepare set_track_prepare() can incur lock recursion. The issue is that it is called from hrtimer_start_range_ns holding the per_cpu(hrtimer_bases)[n].lock, but when enabled CONFIG_DEBUG_OBJECTS_TIMERS, may wake up kswapd in set_track_prepare, and try to hold the per_cpu(hrtimer_bases)[n].lock. Avoid deadlock caused by implicitly waking up kswapd by passing in allocation flags, which do not contain __GFP_KSWAPD_RECLAIM in the debug_objects_fill_pool() case. Inside stack depot they are processed by gfp_nested_mask(). Since ___slab_alloc() has preemption disabled, we mask out __GFP_DIRECT_RECLAIM from the flags there. The oops looks something like: BUG: spinlock recursion on CPU#3, swapper/3/0 lock: 0xffffff8a4bf29c80, .magic: dead4ead, .owner: swapper/3/0, .owner_cpu: 3 Hardware name: Qualcomm Technologies, Inc. Popsicle based on SM8850 (DT) Call trace: spin_bug+0x0 _raw_spin_lock_irqsave+0x80 hrtimer_try_to_cancel+0x94 task_contending+0x10c enqueue_dl_entity+0x2a4 dl_server_start+0x74 enqueue_task_fair+0x568 enqueue_task+0xac do_activate_task+0x14c ttwu_do_activate+0xcc try_to_wake_up+0x6c8 default_wake_function+0x20 autoremove_wake_function+0x1c __wake_up+0xac wakeup_kswapd+0x19c wake_all_kswapds+0x78 __alloc_pages_slowpath+0x1ac __alloc_pages_noprof+0x298 stack_depot_save_flags+0x6b0 stack_depot_save+0x14 set_track_prepare+0x5c ___slab_alloc+0xccc __kmalloc_cache_noprof+0x470 __set_page_owner+0x2bc post_alloc_hook[jt]+0x1b8 prep_new_page+0x28 get_page_from_freelist+0x1edc __alloc_pages_noprof+0x13c alloc_slab_page+0x244 allocate_slab+0x7c ___slab_alloc+0x8e8 kmem_cache_alloc_noprof+0x450 debug_objects_fill_pool+0x22c debug_object_activate+0x40 enqueue_hrtimer[jt]+0xdc hrtimer_start_range_ns+0x5f8 ...
Severity ?
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 5cf909c553e9efed573811de4b3f5172898d5515 , < 994b03b9605d36d814c611385fbf90ca6db20aa8 (git)
Affected: 5cf909c553e9efed573811de4b3f5172898d5515 , < 522ffe298627cfe72539d72167c2e20e72b5e856 (git)
Affected: 5cf909c553e9efed573811de4b3f5172898d5515 , < 243b705a90ed8449f561a271cf251fd2e939f3db (git)
Affected: 5cf909c553e9efed573811de4b3f5172898d5515 , < eb3240ffd243bfb8b1e9dc568d484ecf9fd660ab (git)
Affected: 5cf909c553e9efed573811de4b3f5172898d5515 , < 850470a8413a8a78e772c4f6bd9fe81ec6bd5b0f (git)
Create a notification for this product.
    Linux Linux Affected: 5.19
Unaffected: 0 , < 5.19 (semver)
Unaffected: 6.1.151 , ≤ 6.1.* (semver)
Unaffected: 6.6.105 , ≤ 6.6.* (semver)
Unaffected: 6.12.46 , ≤ 6.12.* (semver)
Unaffected: 6.16.6 , ≤ 6.16.* (semver)
Unaffected: 6.17 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:43:58.958Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "mm/slub.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "994b03b9605d36d814c611385fbf90ca6db20aa8",
              "status": "affected",
              "version": "5cf909c553e9efed573811de4b3f5172898d5515",
              "versionType": "git"
            },
            {
              "lessThan": "522ffe298627cfe72539d72167c2e20e72b5e856",
              "status": "affected",
              "version": "5cf909c553e9efed573811de4b3f5172898d5515",
              "versionType": "git"
            },
            {
              "lessThan": "243b705a90ed8449f561a271cf251fd2e939f3db",
              "status": "affected",
              "version": "5cf909c553e9efed573811de4b3f5172898d5515",
              "versionType": "git"
            },
            {
              "lessThan": "eb3240ffd243bfb8b1e9dc568d484ecf9fd660ab",
              "status": "affected",
              "version": "5cf909c553e9efed573811de4b3f5172898d5515",
              "versionType": "git"
            },
            {
              "lessThan": "850470a8413a8a78e772c4f6bd9fe81ec6bd5b0f",
              "status": "affected",
              "version": "5cf909c553e9efed573811de4b3f5172898d5515",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "mm/slub.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.19"
            },
            {
              "lessThan": "5.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.151",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.105",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.46",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.151",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.105",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.46",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.6",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm: slub: avoid wake up kswapd in set_track_prepare\n\nset_track_prepare() can incur lock recursion.\nThe issue is that it is called from hrtimer_start_range_ns\nholding the per_cpu(hrtimer_bases)[n].lock, but when enabled\nCONFIG_DEBUG_OBJECTS_TIMERS, may wake up kswapd in set_track_prepare,\nand try to hold the per_cpu(hrtimer_bases)[n].lock.\n\nAvoid deadlock caused by implicitly waking up kswapd by passing in\nallocation flags, which do not contain __GFP_KSWAPD_RECLAIM in the\ndebug_objects_fill_pool() case. Inside stack depot they are processed by\ngfp_nested_mask().\nSince ___slab_alloc() has preemption disabled, we mask out\n__GFP_DIRECT_RECLAIM from the flags there.\n\nThe oops looks something like:\n\nBUG: spinlock recursion on CPU#3, swapper/3/0\n lock: 0xffffff8a4bf29c80, .magic: dead4ead, .owner: swapper/3/0, .owner_cpu: 3\nHardware name: Qualcomm Technologies, Inc. Popsicle based on SM8850 (DT)\nCall trace:\nspin_bug+0x0\n_raw_spin_lock_irqsave+0x80\nhrtimer_try_to_cancel+0x94\ntask_contending+0x10c\nenqueue_dl_entity+0x2a4\ndl_server_start+0x74\nenqueue_task_fair+0x568\nenqueue_task+0xac\ndo_activate_task+0x14c\nttwu_do_activate+0xcc\ntry_to_wake_up+0x6c8\ndefault_wake_function+0x20\nautoremove_wake_function+0x1c\n__wake_up+0xac\nwakeup_kswapd+0x19c\nwake_all_kswapds+0x78\n__alloc_pages_slowpath+0x1ac\n__alloc_pages_noprof+0x298\nstack_depot_save_flags+0x6b0\nstack_depot_save+0x14\nset_track_prepare+0x5c\n___slab_alloc+0xccc\n__kmalloc_cache_noprof+0x470\n__set_page_owner+0x2bc\npost_alloc_hook[jt]+0x1b8\nprep_new_page+0x28\nget_page_from_freelist+0x1edc\n__alloc_pages_noprof+0x13c\nalloc_slab_page+0x244\nallocate_slab+0x7c\n___slab_alloc+0x8e8\nkmem_cache_alloc_noprof+0x450\ndebug_objects_fill_pool+0x22c\ndebug_object_activate+0x40\nenqueue_hrtimer[jt]+0xdc\nhrtimer_start_range_ns+0x5f8\n..."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-09-29T06:00:52.386Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/994b03b9605d36d814c611385fbf90ca6db20aa8"
        },
        {
          "url": "https://git.kernel.org/stable/c/522ffe298627cfe72539d72167c2e20e72b5e856"
        },
        {
          "url": "https://git.kernel.org/stable/c/243b705a90ed8449f561a271cf251fd2e939f3db"
        },
        {
          "url": "https://git.kernel.org/stable/c/eb3240ffd243bfb8b1e9dc568d484ecf9fd660ab"
        },
        {
          "url": "https://git.kernel.org/stable/c/850470a8413a8a78e772c4f6bd9fe81ec6bd5b0f"
        }
      ],
      "title": "mm: slub: avoid wake up kswapd in set_track_prepare",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-39843",
    "datePublished": "2025-09-19T15:26:17.758Z",
    "dateReserved": "2025-04-16T07:20:57.141Z",
    "dateUpdated": "2025-11-03T17:43:58.958Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-39843\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-09-19T16:15:43.047\",\"lastModified\":\"2025-11-03T18:16:49.833\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmm: slub: avoid wake up kswapd in set_track_prepare\\n\\nset_track_prepare() can incur lock recursion.\\nThe issue is that it is called from hrtimer_start_range_ns\\nholding the per_cpu(hrtimer_bases)[n].lock, but when enabled\\nCONFIG_DEBUG_OBJECTS_TIMERS, may wake up kswapd in set_track_prepare,\\nand try to hold the per_cpu(hrtimer_bases)[n].lock.\\n\\nAvoid deadlock caused by implicitly waking up kswapd by passing in\\nallocation flags, which do not contain __GFP_KSWAPD_RECLAIM in the\\ndebug_objects_fill_pool() case. Inside stack depot they are processed by\\ngfp_nested_mask().\\nSince ___slab_alloc() has preemption disabled, we mask out\\n__GFP_DIRECT_RECLAIM from the flags there.\\n\\nThe oops looks something like:\\n\\nBUG: spinlock recursion on CPU#3, swapper/3/0\\n lock: 0xffffff8a4bf29c80, .magic: dead4ead, .owner: swapper/3/0, .owner_cpu: 3\\nHardware name: Qualcomm Technologies, Inc. Popsicle based on SM8850 (DT)\\nCall trace:\\nspin_bug+0x0\\n_raw_spin_lock_irqsave+0x80\\nhrtimer_try_to_cancel+0x94\\ntask_contending+0x10c\\nenqueue_dl_entity+0x2a4\\ndl_server_start+0x74\\nenqueue_task_fair+0x568\\nenqueue_task+0xac\\ndo_activate_task+0x14c\\nttwu_do_activate+0xcc\\ntry_to_wake_up+0x6c8\\ndefault_wake_function+0x20\\nautoremove_wake_function+0x1c\\n__wake_up+0xac\\nwakeup_kswapd+0x19c\\nwake_all_kswapds+0x78\\n__alloc_pages_slowpath+0x1ac\\n__alloc_pages_noprof+0x298\\nstack_depot_save_flags+0x6b0\\nstack_depot_save+0x14\\nset_track_prepare+0x5c\\n___slab_alloc+0xccc\\n__kmalloc_cache_noprof+0x470\\n__set_page_owner+0x2bc\\npost_alloc_hook[jt]+0x1b8\\nprep_new_page+0x28\\nget_page_from_freelist+0x1edc\\n__alloc_pages_noprof+0x13c\\nalloc_slab_page+0x244\\nallocate_slab+0x7c\\n___slab_alloc+0x8e8\\nkmem_cache_alloc_noprof+0x450\\ndebug_objects_fill_pool+0x22c\\ndebug_object_activate+0x40\\nenqueue_hrtimer[jt]+0xdc\\nhrtimer_start_range_ns+0x5f8\\n...\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/243b705a90ed8449f561a271cf251fd2e939f3db\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/522ffe298627cfe72539d72167c2e20e72b5e856\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/850470a8413a8a78e772c4f6bd9fe81ec6bd5b0f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/994b03b9605d36d814c611385fbf90ca6db20aa8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/eb3240ffd243bfb8b1e9dc568d484ecf9fd660ab\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.