CVE-2025-39910
- Source
- https://cve.org/CVERecord?id=CVE-2025-39910
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-39910.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2025-39910
- Aliases
- Downstream
- Related
- Published
- 2025-10-01T07:44:33.759Z
- Modified
- 2026-02-09T20:11:25.137757Z
- Severity
-
- 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
- Summary
- mm/vmalloc, mm/kasan: respect gfp mask in kasan_populate_vmalloc()
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
mm/vmalloc, mm/kasan: respect gfp mask in kasanpopulatevmalloc()
kasanpopulatevmalloc() and its helpers ignore the caller's gfpmask and always allocate memory using the hardcoded GFPKERNEL flag. This makes them inconsistent with vmalloc(), which was recently extended to support GFPNOFS and GFPNOIO allocations.
Page table allocations performed during shadow population also ignore the external gfpmask. To preserve the intended semantics of GFPNOFS and GFPNOIO, wrap the applytopagerange() calls into the appropriate memalloc scope.
xfs calls vmalloc with GFP_NOFS, so this bug could lead to deadlock.
There was a report here https://lkml.kernel.org/r/686ea951.050a0220.385921.0016.GAE@google.com
This patch: - Extends kasanpopulatevmalloc() and helpers to take gfpmask; - Passes gfpmask down to allocpagesbulk() and _getfreepage(); - Enforces GFPNOFS/NOIO semantics with memalloc*save()/restore() around applytopage_range(); - Updates vmalloc.c and percpu allocator call sites accordingly.
- Database specific
{ "cna_assigner": "Linux", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/39xxx/CVE-2025-39910.json" }- References
-
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- https://git.kernel.org/stable/c/33b95d90427cb4babf32059e323a6d0c027610fe
- https://git.kernel.org/stable/c/79357cd06d41d0f5a11b17d7c86176e395d10ef2
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/39xxx/CVE-2025-39910.json
- https://nvd.nist.gov/vuln/detail/CVE-2025-39910
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced451769ebb7e792c3404db53b3c2a422990de654eFixed33b95d90427cb4babf32059e323a6d0c027610feFixed79357cd06d41d0f5a11b17d7c86176e395d10ef2