PT-2025-40084 · Xfs+3 · Xfs+3

John.Doe · Published 2025-01-01 · Updated 2026-04-20 · CVE-2025-39910

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The Linux kernel’s kasan populate vmalloc() function and its helpers did not correctly respect the caller’s gfp mask, always using GFP KERNEL instead. This inconsistency with vmalloc(), which supports GFP NOFS and GFP NOIO allocations, could lead to a deadlock, particularly in scenarios where vmalloc is called with GFP NOFS, such as by XFS. The issue stemmed from page table allocations during shadow population also ignoring the external gfp mask. The patch addresses this by extending kasan populate vmalloc() and helpers to accept gfp mask, passing it down to allocation functions, and enforcing GFP NOFS/GFP NOIO semantics around apply to page range().

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Locking

Weakness Enumeration

CWE-477

CWE-667

Related Identifiers

BDU:2026-03275

CVE-2025-39910

ECHO-95A0-FC2B-C4AE

OESA-2026-1337

OESA-2026-1338

OESA-2026-1339

Affected Products

Astra Linux

Debian

Linux Kernel

Xfs

References · 48

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/39xxx/CVE-2025-39910.json · Exploit
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-39910 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-38685 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2025-39910 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-38383 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-50102 · Security Note
• https://git.kernel.org/stable/c/79357cd06d41d0f5a11b17d7c86176e395d10ef2 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-38449 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-39838 · Security Note
• https://cve.org/CVERecord?id=CVE-2025-39910 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-39910 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-39721 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-38678 · Security Note
• https://osv.dev/vulnerability/OESA-2026-1338 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2025-39910 · Vendor Advisory