Critical Memory Allocation Vulnerability in Linux Kernel - CVE-2025-38029
Summary
CVE-2025-38029: In the Linux kernel, the following vulnerability has been resolved: kasan: avoid sleepable page allocation from atomic context apply_to_pte_range() enters the lazy MMU mode and then invokes kasan_populate_vmalloc_pte() c... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interaction. It is known for its stability, performance, and security features. However, it is also susceptible to vulnerabilities that can compromise system integrity. CVE-2025-38029 highlights a significant issue related to memory allocation that can lead to system crashes under specific conditions.
Vulnerability Detail
CVE-2025-38029 is a vulnerability in the Linux kernel that arises from improper handling of page allocations in atomic contexts. Specifically, the function apply_to_pte_range() can enter a lazy MMU mode and invoke a callback that may attempt to allocate a page, which can lead to a sleep operation. This is problematic because sleeping in an atomic context can cause system crashes, particularly on the s390 architecture where preemption is disabled during lazy MMU mode transitions. The vulnerability can lead to system instability and potential denial of service.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid triggering the vulnerability by ensuring that the system does not enter lazy MMU mode during critical operations. However, this is not a permanent solution and updating the kernel is strongly advised.
Conclusion
CVE-2025-38029 represents a critical vulnerability in the Linux kernel that can lead to system crashes due to improper memory allocation handling. It is essential for users to update their systems to the latest patched versions of the kernel to mitigate this risk. Temporary workarounds may help, but they are not substitutes for a proper update.
See every vulnerability recorded for linux →
FAQ
CVE-2025-38029 is a vulnerability in the Linux kernel that can cause system crashes due to improper memory allocation in atomic contexts.
The vulnerability affects Linux kernel versions used in Debian 11, 12, and 13, particularly on s390 architecture.
You can use tools like Vulert, which allows you to monitor and alert for open-source vulnerabilities in your software by analyzing a manifest file like package-lock.json.
If immediate updates are not possible, consider applying workarounds to prevent the system from entering lazy MMU mode during critical operations.
Detailed information about CVE-2025-38029 can be found in the official CVE database and through security advisories from Linux distributions.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
