Soft Lockup Vulnerability in Linux Kernel Affecting Debian Packages
Summary
CVE-2025-39737: In the Linux kernel, the following vulnerability has been resolved: mm/kmemleak: avoid soft lockup in kmemleak_do_cleanup() A soft lockup warning was observed on a relative small system x86-64 system with 16 GB of memory... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Debian operating system, responsible for managing hardware resources and providing essential services to applications. It is known for its stability, performance, and security features. However, vulnerabilities can arise, impacting system performance and reliability. This specific vulnerability affects various Debian versions, highlighting the importance of timely updates and monitoring.
Vulnerability Detail
In the Linux kernel, a soft lockup vulnerability was identified in the kmemleak subsystem. This issue occurs when the system experiences a delay in processing kmemleak objects, particularly under heavy workloads with memory management operations. The vulnerability can lead to system instability, as evidenced by a soft lockup warning indicating that a CPU has been stuck for an extended period. The root cause lies in the inefficient handling of kmemleak object deletions, which can be exacerbated in debug kernels with limited memory allocation.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid the soft lockup by disabling the kmemleak feature in the kernel configuration if it is not critical for your workload. This can be done by modifying the kernel parameters or recompiling the kernel without kmemleak support.
Conclusion
The soft lockup vulnerability in the Linux kernel poses a significant risk to system stability across various Debian versions. By understanding the nature of this vulnerability and applying the necessary updates, users can protect their systems from potential disruptions. Utilizing tools like Vulert can further enhance security by providing real-time monitoring for open-source vulnerabilities.
See every vulnerability recorded for linux →
FAQ
A soft lockup occurs when a CPU is unable to execute tasks for an extended period, leading to system performance degradation and potential instability.
You can use Vulert, which monitors open-source vulnerabilities in your software. By simply uploading your manifest file, you can check for vulnerabilities without needing to install any software.
The vulnerability affects Debian versions 11, 12, 13, and 14, with specific patched versions available for the latter two.
While the primary concern is system instability, there is a potential risk of data loss if the system becomes unresponsive and requires a forced reboot.
It is recommended to regularly check for updates and apply them promptly, especially when vulnerabilities are disclosed, to maintain system security and performance.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
