Deadlock Vulnerability in Linux Kernel - Impacting Debian Linux Packages
Summary
CVE-2025-39736: In the Linux kernel, the following vulnerability has been resolved: mm/kmemleak: avoid deadlock by moving pr_warn() outside kmemleak_lock When netpoll is enabled, calling pr_warn_once() while holding kmemleak_lock in mem... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing hardware resources and providing essential services to applications. It is widely used in various distributions, including Debian. The kernel's stability and security are crucial for the overall performance and reliability of systems running on Linux. This vulnerability affects multiple versions of the Linux package in Debian, highlighting the importance of timely updates and patches.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the memory management subsystem, specifically within the kmemleak functionality. The issue arises when netpoll is enabled, leading to a potential deadlock scenario. This occurs because the function pr_warn_once() is called while holding the kmemleak_lock, which can trigger netpoll and cause a lock inversion with the netconsole subsystem. The deadlock path involves multiple function calls that eventually attempt to reacquire the kmemleak_lock, resulting in a system hang. The vulnerability is critical as it can lead to system instability and unresponsiveness.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. However, avoiding the use of netpoll while the kmemleak functionality is active may reduce the risk of encountering the deadlock.
Conclusion
The identified vulnerability in the Linux kernel poses a significant risk of deadlock under specific conditions. It is crucial for users of affected Debian versions to apply the necessary updates to ensure system stability and security. Regular monitoring and timely patching are essential practices for maintaining a secure environment.
See every vulnerability recorded for linux →
FAQ
The vulnerability is a deadlock issue in the Linux kernel's memory management subsystem, which can occur when netpoll is enabled.
Debian 11, 12, 13, and 14 are affected, with specific fixed versions available for Debian 13 and 14.
You can check your system's Linux package version and compare it with the fixed versions mentioned in the vulnerability report.
If immediate updates are not possible, consider disabling netpoll functionality to mitigate the risk of deadlock.
Detailed information can be found in the CVE report for CVE-2025-39736, which outlines the vulnerability and its implications.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
