Kernel Deadlock Vulnerability in Linux Package: CVE-2025-39843
Summary
CVE-2025-39843: In the Linux kernel, the following vulnerability has been resolved: mm: slub: avoid wake up kswapd in set_track_prepare set_track_prepare() can incur lock recursion. Affects linux versions 6.1.106-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing system resources and facilitating communication between hardware and software. It is widely used across various platforms, from servers to embedded systems. This vulnerability affects multiple Debian versions (12, 13, and 14) of the Linux package, highlighting its critical role in system stability and performance.
Vulnerability Detail
In the Linux kernel, a vulnerability identified as CVE-2025-39843 has been discovered in the memory management subsystem, specifically within the SLUB allocator. The issue arises from the function set_track_prepare(), which can lead to lock recursion when called from hrtimer_start_range_ns while holding a lock. This can inadvertently wake up kswapd, causing a potential deadlock situation. The ramifications include system instability and crashes, particularly under high memory pressure scenarios, which could lead to service interruptions and degraded performance.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid triggering the deadlock by ensuring that the allocation flags do not include __GFP_KSWAPD_RECLAIM during memory allocation operations. This may involve modifying the allocation calls in the affected code paths to use safer flags.
Conclusion
CVE-2025-39843 represents a significant vulnerability in the Linux kernel that can lead to severe system issues. It is crucial for users to apply the necessary updates to mitigate the risks associated with this vulnerability. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for linux →
FAQ
CVE-2025-39843 is a vulnerability in the Linux kernel that can lead to deadlock due to lock recursion in memory management functions.
Debian versions 12, 13, and 14 are affected by this vulnerability in the Linux package.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The vulnerability can lead to system instability, crashes, and degraded performance, especially under high memory usage scenarios.
Yes, a patch is available for Debian 14 in version 6.16.6-1. Users of Debian 12 and 13 should check for updates.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
