CVE-2025-38510

kasan: remove kasan_find_vm_area() to prevent possible deadlock

Description

In the Linux kernel, the following vulnerability has been resolved: kasan: remove kasan_find_vm_area() to prevent possible deadlock find_vm_area() couldn't be called in atomic_context. If find_vm_area() is called to reports vm area information, kasan can trigger deadlock like: CPU0 CPU1 vmalloc(); alloc_vmap_area(); spin_lock(&vn->busy.lock) spin_lock_bh(&some_lock); <interrupt occurs> <in softirq> spin_lock(&some_lock); <access invalid address> kasan_report(); print_report(); print_address_description(); kasan_find_vm_area(); find_vm_area(); spin_lock(&vn->busy.lock) // deadlock! To prevent possible deadlock while kasan reports, remove kasan_find_vm_area().

N/A

CVSS

Severity:

EPSS 0.02%

Affected: Linux Linux

References

Link	Tags
https://git.kernel.org/stable/c/595f78d99b9051600233c0a5c4c47e1097e6ed01
https://git.kernel.org/stable/c/8377d7744bdce5c4b3f1b58924eebd3fdc078dfc
https://git.kernel.org/stable/c/2d89dab1ea6086e6cbe6fe92531b496fb6808cb9
https://git.kernel.org/stable/c/0c3566d831def922cd56322c772a7b20d8b0e0c0
https://git.kernel.org/stable/c/6ee9b3d84775944fb8c8a447961cd01274ac671c

Frequently Asked Questions

What is the severity of CVE-2025-38510?: CVE-2025-38510 has not yet been assigned a CVSS score.
How to fix CVE-2025-38510?: To fix CVE-2025-38510, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2025-38510 being actively exploited in the wild?: As for now, there are no information to confirm that CVE-2025-38510 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2025-38510?: CVE-2025-38510 affects Linux Linux, Linux Linux.

This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.