In the Linux kernel, the following vulnerability has been resolved:
kasan: remove kasan_find_vm_area() to prevent possible deadlock
find_vm_area() couldn't be called in atomic_context. If find_vm_area() is
called to reports vm area information, kasan can trigger deadlock like:
CPU0 CPU1
vmalloc();
alloc_vmap_area();
spin_lock(&vn->busy.lock)
spin_lock_bh(&some_lock);
<interrupt occurs>
<in softirq>
spin_lock(&some_lock);
<access invalid address>
kasan_report();
print_report();
print_address_description();
kasan_find_vm_area();
find_vm_area();
spin_lock(&vn->busy.lock) // deadlock!
To prevent possible deadlock while kasan reports, remove kasan_find_vm_area().
References
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
History
07 Jan 2026, 18:00
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://git.kernel.org/stable/c/0c3566d831def922cd56322c772a7b20d8b0e0c0 - Patch | |
| References | () https://git.kernel.org/stable/c/2d89dab1ea6086e6cbe6fe92531b496fb6808cb9 - Patch | |
| References | () https://git.kernel.org/stable/c/595f78d99b9051600233c0a5c4c47e1097e6ed01 - Patch | |
| References | () https://git.kernel.org/stable/c/6ee9b3d84775944fb8c8a447961cd01274ac671c - Patch | |
| References | () https://git.kernel.org/stable/c/8377d7744bdce5c4b3f1b58924eebd3fdc078dfc - Patch | |
| References | () https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html - Third Party Advisory, Mailing List | |
| CWE | CWE-476 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.5 |
| First Time |
Linux
Debian Debian debian Linux Linux linux Kernel |
|
| CPE | cpe:2.3:o:linux:linux_kernel:6.16:rc2:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:* cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.16:rc3:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.16:rc5:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.16:rc4:*:*:*:*:*:* |
03 Nov 2025, 18:16
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
18 Aug 2025, 20:16
| Type | Values Removed | Values Added |
|---|---|---|
| Summary |
|
16 Aug 2025, 11:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-08-16 11:15
Updated : 2026-01-07 18:00
NVD link : CVE-2025-38510
Mitre link : CVE-2025-38510
CVE.ORG link : CVE-2025-38510
JSON object : View
Products Affected
debian
- debian_linux
linux
- linux_kernel
CWE
CWE-476
NULL Pointer Dereference