Race Condition Vulnerability in Linux Kernel - CVE-2025-39754
Summary
CVE-2025-39754: In the Linux kernel, the following vulnerability has been resolved: mm/smaps: fix race between smaps_hugetlb_range and migration smaps_hugetlb_range() handles the pte without holdling ptl, and may be concurrenct with mig... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, managing hardware resources and providing essential services for software applications. It is known for its stability, performance, and scalability. However, like any complex software, it can be susceptible to vulnerabilities. CVE-2025-39754 highlights a race condition issue in the memory management subsystem, specifically within the smaps_hugetlb_range function, which can lead to critical system errors.
Vulnerability Detail
CVE-2025-39754 is a race condition vulnerability in the Linux kernel's memory management subsystem. The issue arises when the smaps_hugetlb_range function handles page table entries (PTEs) without holding the necessary lock (ptl), allowing concurrent execution with the migration of pages. This can lead to a situation where the system encounters a 'BUG_ON' error during the migration process, potentially causing system instability or crashes. The vulnerability affects multiple Debian versions of the Linux package.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is recommended to apply the patch as soon as it is available.
Conclusion
CVE-2025-39754 represents a significant vulnerability in the Linux kernel that can affect system stability due to a race condition in memory management. It is crucial for users of affected Debian versions to apply the necessary updates to safeguard their systems against potential crashes.
See every vulnerability recorded for linux →
FAQ
CVE-2025-39754 is a race condition vulnerability in the Linux kernel that can lead to system instability.
Debian 11, 12, 13, and 14 are affected, with specific fixed versions available for Debian 13 and 14.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected.
The vulnerability can lead to critical errors in the system, potentially causing crashes or instability during memory management operations.
Yes, patches are available for Debian 13 and 14. Ensure to update to the specified versions to mitigate the vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
