CVE-2025-39843: mm: slub: avoid wake up kswapd in set_track_prepare

Published Sep 19, 2025
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

mm: slub: avoid wake up kswapd in settrackprepare

settrackprepare() can incur lock recursion. The issue is that it is called from hrtimerstartrangens holding the percpu(hrtimerbases)[n].lock, but when enabled CONFIGDEBUGOBJECTSTIMERS, may wake up kswapd in settrackprepare, and try to hold the percpu(hrtimerbases)[n].lock.

Avoid deadlock caused by implicitly waking up kswapd by passing in allocation flags, which do not contain GFPKSWAPDRECLAIM in the debugobjectsfillpool() case. Inside stack depot they are processed by gfpnestedmask(). Since slaballoc() has preemption disabled, we mask out GFPDIRECTRECLAIM from the flags there.

The oops looks something like:

BUG: spinlock recursion on CPU#3, swapper/3/0 lock: 0xffffff8a4bf29c80, .magic: dead4ead, .owner: swapper/3/0, .ownercpu: 3 Hardware name: Qualcomm Technologies, Inc. Popsicle based on SM8850 (DT) Call trace: spinbug+0x0 rawspinlockirqsave+0x80 hrtimertrytocancel+0x94 taskcontending+0x10c enqueuedlentity+0x2a4 dlserverstart+0x74 enqueuetaskfair+0x568 enqueuetask+0xac doactivatetask+0x14c ttwudoactivate+0xcc trytowakeup+0x6c8 defaultwakefunction+0x20 autoremovewakefunction+0x1c wakeup+0xac wakeupkswapd+0x19c wakeallkswapds+0x78 allocpagesslowpath+0x1ac allocpagesnoprof+0x298 stackdepotsaveflags+0x6b0 stackdepotsave+0x14 settrackprepare+0x5c slaballoc+0xccc kmalloccachenoprof+0x470 setpageowner+0x2bc postallochook[jt]+0x1b8 prepnewpage+0x28 getpagefromfreelist+0x1edc allocpagesnoprof+0x13c allocslabpage+0x244 allocateslab+0x7c slaballoc+0x8e8 kmemcacheallocnoprof+0x450 debugobjectsfillpool+0x22c debugobjectactivate+0x40 enqueuehrtimer[jt]+0xdc hrtimerstartrangens+0x5f8 ...

Affected Software

148 affected componentsFixes available
Linux Linux kernel
IBM Verify Identity Access<=11.0 - 11.0.2
IBM Security Verify Access<=10.0 - 10.0.9.1
IBM Verify Identity Access Container<=11.0 - 11.0.2
IBM Security Verify Access Container<=10.0 - 10.0.9.1
Linux Linux kernel>=5.19<6.1.151
Linux Linux kernel>=6.2<6.6.105
Linux Linux kernel>=6.7<6.12.46
Linux Linux kernel>=6.13<6.16.6
Linux Linux kernel=6.17-rc1
Linux Linux kernel=6.17-rc2
Linux Linux kernel=6.17-rc3
Linux Linux kernel=6.17-rc4
Debian Debian Linux=11.0
debian/linux
6.1.176-16.1.190-16.12.107-16.12.115-27.2.12-17.2.15-1
ubuntu/linux-hwe-edge*
ubuntu/linux-aws-5.0*
ubuntu/linux-aws-5.3*
ubuntu/linux-azure*
ubuntu/linux-azure-5.3*
ubuntu/linux-azure-edge*
ubuntu/linux-gcp*
ubuntu/linux-gcp-5.3*
ubuntu/linux-gke-4.15*
ubuntu/linux-gke-5.4*
ubuntu/linux-gkeop-5.4*
ubuntu/linux-hwe*
ubuntu/linux-hwe-edge*
ubuntu/linux-oem*
ubuntu/linux-oracle-5.0*
ubuntu/linux-oracle-5.3*
ubuntu/linux-aws-5.11*
ubuntu/linux-aws-5.13*
ubuntu/linux-aws-5.8*
ubuntu/linux-azure-5.11*
ubuntu/linux-azure-5.13*
ubuntu/linux-azure-5.8*
ubuntu/linux-azure-fde*
ubuntu/linux-gcp-5.11*
ubuntu/linux-gcp-5.13*
ubuntu/linux-gcp-5.8*
ubuntu/linux-gke*
ubuntu/linux-gke-5.15*
ubuntu/linux-gkeop*
ubuntu/linux-gkeop-5.15*
ubuntu/linux-hwe-5.11*
ubuntu/linux-hwe-5.13*
ubuntu/linux-hwe-5.8*
ubuntu/linux-intel-5.13*
ubuntu/linux-oem-5.10*
ubuntu/linux-oem-5.13*
ubuntu/linux-oem-5.6*
ubuntu/linux-oracle-5.11*
ubuntu/linux-oracle-5.13*
ubuntu/linux-oracle-5.8*
ubuntu/linux-raspi2*
ubuntu/linux-riscv*
ubuntu/linux-riscv-5.11*
ubuntu/linux-riscv-5.8*
ubuntu/linux-allwinner-5.19*
ubuntu/linux-aws-5.19*
ubuntu/linux-aws-6.2*
ubuntu/linux-aws-6.5*
ubuntu/linux-aws-6.8<6.8.0-1050.53~22.04.1
6.8.0-1050.53~22.04.1
ubuntu/linux-azure-5.19*
ubuntu/linux-azure-6.2*
ubuntu/linux-azure-6.5*
ubuntu/linux-azure-6.8<6.8.0-1051.57~22.04.1
6.8.0-1051.57~22.04.1
ubuntu/linux-azure-fde-5.19*
ubuntu/linux-azure-fde-6.2*
ubuntu/linux-azure-fde-6.8<6.8.0-1058.65~22.04.1
6.8.0-1058.65~22.04.1
ubuntu/linux-gcp-5.19*
ubuntu/linux-gcp-6.2*
ubuntu/linux-gcp-6.5*
ubuntu/linux-gcp-6.8<6.8.0-1052.55~22.04.1
6.8.0-1052.55~22.04.1
ubuntu/linux-hwe-5.19*
ubuntu/linux-hwe-6.2*
ubuntu/linux-hwe-6.5*
ubuntu/linux-hwe-6.8<6.8.0-106.106~22.04.1
6.8.0-106.106~22.04.1
ubuntu/linux-ibm-6.8<6.8.0-1049.49~22.04.1
6.8.0-1049.49~22.04.1
ubuntu/linux-intel-iot-realtime*
ubuntu/linux-lowlatency-hwe-5.19*
ubuntu/linux-lowlatency-hwe-6.2*
ubuntu/linux-lowlatency-hwe-6.5*
ubuntu/linux-lowlatency-hwe-6.8<6.8.0-106.106.1~22.04.1
6.8.0-106.106.1~22.04.1
ubuntu/linux-nvidia-6.2*
ubuntu/linux-nvidia-6.5*
ubuntu/linux-nvidia-6.8<6.8.0-1049.52~22.04.1
6.8.0-1049.52~22.04.1
ubuntu/linux-oem-5.17*
ubuntu/linux-oem-6.0*
ubuntu/linux-oem-6.1*
ubuntu/linux-oem-6.5*
ubuntu/linux-oracle-6.5*
ubuntu/linux-oracle-6.8<6.8.0-1047.48~22.04.1
6.8.0-1047.48~22.04.1
ubuntu/linux-realtime*
ubuntu/linux-riscv*
ubuntu/linux-riscv-5.19*
ubuntu/linux-riscv-6.5*
ubuntu/linux-riscv-6.8<6.8.0-106.106~22.04.1
6.8.0-106.106~22.04.1
ubuntu/linux-starfive-5.19*
ubuntu/linux-starfive-6.2*
ubuntu/linux-starfive-6.5*
ubuntu/linux-realtime-6.8<6.8.1-1045.46~22.04.1
6.8.1-1045.46~22.04.1
ubuntu/linux<6.8.0-106.106
6.8.0-106.106
ubuntu/linux-aws<6.8.0-1050.53
6.8.0-1050.53
ubuntu/linux-aws-6.14*
ubuntu/linux-azure<6.8.0-1051.57
6.8.0-1051.57
ubuntu/linux-azure-6.11*
ubuntu/linux-azure-6.14*
ubuntu/linux-azure-fde<6.8.0-1058.65
6.8.0-1058.65
ubuntu/linux-azure-fde-6.14*
ubuntu/linux-azure-nvidia*
ubuntu/linux-azure-nvidia-6.14*
ubuntu/linux-gcp<6.8.0-1052.55
6.8.0-1052.55
ubuntu/linux-gcp-6.11*
ubuntu/linux-gcp-6.14*
ubuntu/linux-gke<6.8.0-1048.53
6.8.0-1048.53
ubuntu/linux-gkeop<6.8.0-1035.38
6.8.0-1035.38
ubuntu/linux-hwe-6.11*
ubuntu/linux-hwe-6.14*
ubuntu/linux-ibm<6.8.0-1049.49
6.8.0-1049.49
ubuntu/linux-intel*
ubuntu/linux-lowlatency<6.8.0-106.106.1
6.8.0-106.106.1
ubuntu/linux-lowlatency-hwe-6.11*
ubuntu/linux-nvidia<6.8.0-1049.52
6.8.0-1049.52
ubuntu/linux-nvidia-6.11*
ubuntu/linux-nvidia-lowlatency<6.8.0-1049.52.1
6.8.0-1049.52.1
ubuntu/linux-nvidia-tegra<6.8.0-1020.20
6.8.0-1020.20
ubuntu/linux-oem-6.11*
ubuntu/linux-oem-6.14*
ubuntu/linux-oem-6.8*
ubuntu/linux-oracle<6.8.0-1047.48
6.8.0-1047.48
ubuntu/linux-oracle-6.14*
ubuntu/linux-raspi<6.8.0-1050.54
6.8.0-1050.54
ubuntu/linux-raspi-realtime*
ubuntu/linux-realtime*
ubuntu/linux-riscv*
ubuntu/linux-riscv-6.14*
ubuntu/linux-xilinx<6.8.0-1028.29
6.8.0-1028.29
ubuntu/linux-bluefield<6.8.0-1017.21
6.8.0-1017.21
ubuntu/linux-raspi-realtime<6.8.0-2040.41
6.8.0-2040.41
ubuntu/linux-realtime<6.8.1-1045.46
6.8.1-1045.46
ubuntu/linux-realtime-6.14*
ubuntu/linux-aws-fips<6.8.0-1050.53+fips1
6.8.0-1050.53+fips1
ubuntu/linux-azure-fips<6.8.0-1052.58+fips1
6.8.0-1052.58+fips1
ubuntu/linux-fips<6.8.0-106.106+fips1
6.8.0-106.106+fips1
ubuntu/linux-gcp-fips<6.8.0-1052.55+fips1
6.8.0-1052.55+fips1
ubuntu/linux-azure-fde*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade debian/linux to a version that resolves this vulnerability.

    Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1
  2. Upgrade

    Upgrade ubuntu/linux-aws-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-1050.53~22.04.1
  3. Upgrade

    Upgrade ubuntu/linux-azure-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-1051.57~22.04.1
  4. Upgrade

    Upgrade ubuntu/linux-azure-fde-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-1058.65~22.04.1
  5. Upgrade

    Upgrade ubuntu/linux-gcp-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-1052.55~22.04.1
  6. Upgrade

    Upgrade ubuntu/linux-hwe-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-106.106~22.04.1
  7. Upgrade

    Upgrade ubuntu/linux-ibm-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-1049.49~22.04.1
  8. Upgrade

    Upgrade ubuntu/linux-lowlatency-hwe-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-106.106.1~22.04.1
  9. Upgrade

    Upgrade ubuntu/linux-nvidia-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-1049.52~22.04.1
  10. Upgrade

    Upgrade ubuntu/linux-oracle-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-1047.48~22.04.1
  11. Upgrade

    Upgrade ubuntu/linux-riscv-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-106.106~22.04.1
  12. Upgrade

    Upgrade ubuntu/linux-realtime-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.1-1045.46~22.04.1
  13. Upgrade

    Upgrade ubuntu/linux to a version that resolves this vulnerability.

    Fixed in 6.8.0-106.106
  14. Upgrade

    Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.

    Fixed in 6.8.0-1050.53
  15. Upgrade

    Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.

    Fixed in 6.8.0-1051.57
  16. Upgrade

    Upgrade ubuntu/linux-azure-fde to a version that resolves this vulnerability.

    Fixed in 6.8.0-1058.65
  17. Upgrade

    Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.

    Fixed in 6.8.0-1052.55
  18. Upgrade

    Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.

    Fixed in 6.8.0-1048.53
  19. Upgrade

    Upgrade ubuntu/linux-gkeop to a version that resolves this vulnerability.

    Fixed in 6.8.0-1035.38
  20. Upgrade

    Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.

    Fixed in 6.8.0-1049.49
  21. Upgrade

    Upgrade ubuntu/linux-lowlatency to a version that resolves this vulnerability.

    Fixed in 6.8.0-106.106.1
  22. Upgrade

    Upgrade ubuntu/linux-nvidia to a version that resolves this vulnerability.

    Fixed in 6.8.0-1049.52
  23. Upgrade

    Upgrade ubuntu/linux-nvidia-lowlatency to a version that resolves this vulnerability.

    Fixed in 6.8.0-1049.52.1
  24. Upgrade

    Upgrade ubuntu/linux-nvidia-tegra to a version that resolves this vulnerability.

    Fixed in 6.8.0-1020.20
  25. Upgrade

    Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.

    Fixed in 6.8.0-1047.48
  26. Upgrade

    Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.

    Fixed in 6.8.0-1050.54
  27. Upgrade

    Upgrade ubuntu/linux-xilinx to a version that resolves this vulnerability.

    Fixed in 6.8.0-1028.29
  28. Upgrade

    Upgrade ubuntu/linux-bluefield to a version that resolves this vulnerability.

    Fixed in 6.8.0-1017.21
  29. Upgrade

    Upgrade ubuntu/linux-raspi-realtime to a version that resolves this vulnerability.

    Fixed in 6.8.0-2040.41
  30. Upgrade

    Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.

    Fixed in 6.8.1-1045.46
  31. Upgrade

    Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.

    Fixed in 6.8.0-1050.53+fips1
  32. Upgrade

    Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.

    Fixed in 6.8.0-1052.58+fips1
  33. Upgrade

    Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.

    Fixed in 6.8.0-106.106+fips1
  34. Upgrade

    Upgrade ubuntu/linux-gcp-fips to a version that resolves this vulnerability.

    Fixed in 6.8.0-1052.55+fips1
  35. Compensating control

    In the kernel SLUB/debug-object allocation path, prevent kswapd wakeups during set_track_prepare by passing allocation flags without __GFP_KSWAPD_RECLAIM in debug_objects_fill_pool(); also mask out __GFP_DIRECT_RECLAIM in ___slab_alloc() because preemption is disabled there.

Event History

Sep 19, 2025
CVE Published
via MITRE·03:26 PM
Data Sourced
via MITRE·03:26 PM
Description
Data Sourced
via Red Hat·04:03 PM
DescriptionSeverityAffected Software
Data Sourced
via OSV·04:15 PM
DescriptionSeverityAffected Software
Data Sourced
via NVD·04:15 PM
RemedyDescriptionSeverityWeaknessAffected Software
Sep 21, 2025
Data Sourced
via Microsoft·01:01 AM
DescriptionSeverityWeakness
Jul 8, 2026
Data Sourced
via IBM·12:00 AM
DescriptionAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

1

What is the severity of CVE-2025-39843?

CVE-2025-39843 has been classified as a medium severity vulnerability due to the potential for lock recursion.

2

How do I fix CVE-2025-39843?

To fix CVE-2025-39843, update to the latest version of the Linux kernel that includes the patch addressing this issue.

3

What systems are affected by CVE-2025-39843?

CVE-2025-39843 affects the Linux kernel, specifically versions that include the vulnerable code in set_track_prepare.

4

Is CVE-2025-39843 exploitable remotely?

CVE-2025-39843 is not known to be easily exploitable remotely, focusing more on local privilege escalation risks.

5

What are the potential consequences of CVE-2025-39843?

The potential consequences of CVE-2025-39843 include system instability and possible denial of service due to lock contention.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203