CVE-2025-39736

mm/kmemleak: avoid deadlock by moving pr_warn() outside kmemleak_lock

MEDIUM
5.5
CVSS Score
Published: September 11, 2025 at 04:52 PM UTC
Updated: October 19, 2026 at 09:10 PM UTC
3 products affected across 3 vendorsLinux KernelDebian LinuxSIMATIC CN 4100

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Severity
MEDIUM5.5
Exploit prediction
EPSS 0.1%

Description

In the Linux kernel, the following vulnerability has been resolved: mm/kmemleak: avoid deadlock by moving pr_warn() outside kmemleak_lock When netpoll is enabled, calling pr_warn_once() while holding kmemleak_lock in mem_pool_alloc() can cause a deadlock due to lock inversion with the netconsole subsystem. This occurs because pr_warn_once() may trigger netpoll, which eventually leads to __alloc_skb() and back into kmemleak code, attempting to reacquire kmemleak_lock. This is the path for the deadlock. mem_pool_alloc() -> raw_spin_lock_irqsave(&kmemleak_lock, flags); -> pr_warn_once() -> netconsole subsystem -> netpoll -> __alloc_skb -> __create_object -> raw_spin_lock_irqsave(&kmemleak_lock, flags); Fix this by setting a flag and issuing the pr_warn_once() after kmemleak_lock is released.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

5.11 ≤ v < 5.15.1905.16 ≤ v < 6.1.1495.4 ≤ v < 5.4.2975.5 ≤ v < 5.10.2416.13 ≤ v < 6.15.116.16 ≤ v < 6.16.26.2 ≤ v < 6.6.1036.7 ≤ v < 6.12.435.46.176.17 rc1c5665868183fec689dbab9fb8505188b2c4f0757
Vendor states this is fixed in 08f70be5e406ce47c822f2dd11c1170ca259605b (fixed)
Vendor states this is fixed in 1da95d3d4b7b1d380ebd87b71a61e7e6aed3265d (fixed)
Vendor states this is fixed in 47b0f6d8f0d2be4d311a49e13d2fd5f152f492b2 (fixed)
Vendor states this is fixed in 4b0151e1d468eb2667c37b7af99b3c075072d334 (fixed)
Vendor states this is fixed in 62879faa8efe8d8a9c7bf7606ee9c068012d7dac (fixed)
Vendor states this is fixed in a0854de00ce2ee27edf39037e7836ad580eb3350 (fixed)
Vendor states this is fixed in a181b228b37a6a5625dad2bb4265bb7abb673e9f (fixed)
Vendor states this is fixed in c7b6ea0ede687e7460e593c5ea478f50aa41682a (fixed)
Vendor states this is fixed in f249d32bb54876b4b6c3ae071af8ddca77af390b (fixed)
Vendor states this is fixed in 5.10.241 (unaffected)
Vendor states this is fixed in 5.15.190 (unaffected)
Vendor states this is fixed in 5.4 (unaffected)
Vendor states this is fixed in 5.4.297 (unaffected)
Vendor states this is fixed in 6.1.149 (unaffected)
Vendor states this is fixed in 6.12.43 (unaffected)
Vendor states this is fixed in 6.15.11 (unaffected)
Vendor states this is fixed in 6.16.2 (unaffected)
Vendor states this is fixed in 6.17 (unaffected)
Vendor states this is fixed in 6.6.103 (unaffected)
v < V5.0
Affected range stops below V5.0, so it looks safe — our inference, not a vendor statement

References (12)

Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/08f70be5e406ce47c822f2dd11c1170ca259605b
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/1da95d3d4b7b1d380ebd87b71a61e7e6aed3265d
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/47b0f6d8f0d2be4d311a49e13d2fd5f152f492b2
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/4b0151e1d468eb2667c37b7af99b3c075072d334
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/62879faa8efe8d8a9c7bf7606ee9c068012d7dac
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/a0854de00ce2ee27edf39037e7836ad580eb3350
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/a181b228b37a6a5625dad2bb4265bb7abb673e9f
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/c7b6ea0ede687e7460e593c5ea478f50aa41682a

CVSS

Attack Vector
LOCAL
Complexity
LOW
Privileges
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
NONE
Availability
HIGH
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-667

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Free plan, no card