Memory Allocation Vulnerability in Linux Kernel: Impacting Debian Linux Packages
Summary
DEBIAN-CVE-2025-39910: In the Linux kernel, the following vulnerability has been resolved: mm/vmalloc, mm/kasan: respect gfp mask in kasan_populate_vmalloc() kasan_populate_vmalloc() and its helpers ignore the caller's gfp_mask and always allo... Affects linux versions 6.1.106-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing system resources and facilitating communication between hardware and software. It is widely used across various distributions, including Debian. This vulnerability affects multiple versions of the Linux package in Debian, specifically versions 12, 13, and 14, highlighting a critical issue in memory allocation that could lead to system instability.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the memory allocation functions, specifically within kasan_populate_vmalloc(). This function disregards the caller's gfp_mask and consistently allocates memory using the hardcoded GFP_KERNEL flag. This inconsistency with vmalloc(), which supports GFP_NOFS and GFP_NOIO allocations, can lead to deadlocks, particularly in scenarios where XFS calls vmalloc with GFP_NOFS. The issue arises from the failure to respect the intended semantics of memory allocation flags, potentially causing severe system performance issues.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is recommended to apply the patch as soon as it is available to mitigate any risks associated with this issue.
Conclusion
The identified vulnerability in the Linux kernel poses significant risks to Debian systems, particularly concerning memory allocation. Users are strongly encouraged to update their Linux packages to the patched version to ensure system stability and security. Monitoring tools like Vulert can assist in identifying vulnerabilities in real-time.
See every vulnerability recorded for linux →
FAQ
The vulnerability involves improper memory allocation in the Linux kernel that could lead to deadlocks.
Debian versions 12, 13, and 14 are affected by this vulnerability.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected.
While there are no specific workarounds, it is advisable to monitor your system for unusual behavior and apply the patch as soon as possible.
Detailed information can be found in the CVE report for DEBIAN-CVE-2025-39910, which outlines the technical aspects and implications of the vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
