CVE-2025-39910: mm/vmalloc, mm/kasan: respect gfp mask in kasan_populate_vmalloc()
In the Linux kernel, the following vulnerability has been resolved:
mm/vmalloc, mm/kasan: respect gfp mask in kasanpopulatevmalloc()
kasanpopulatevmalloc() and its helpers ignore the caller's gfpmask and always allocate memory using the hardcoded GFPKERNEL flag. This makes them inconsistent with vmalloc(), which was recently extended to support GFPNOFS and GFPNOIO allocations.
Page table allocations performed during shadow population also ignore the external gfpmask. To preserve the intended semantics of GFPNOFS and GFPNOIO, wrap the applytopagerange() calls into the appropriate memalloc scope.
xfs calls vmalloc with GFPNOFS, so this bug could lead to deadlock.
There was a report here https://lkml.kernel.org/r/686ea951.050a0220.385921.0016.GAE@google.com
This patch: - Extends kasanpopulatevmalloc() and helpers to take gfpmask; - Passes gfpmask down to allocpagesbulk() and getfreepage(); - Enforces GFPNOFS/NOIO semantics with memallocsave()/restore() around applytopagerange(); - Updates vmalloc.c and percpu allocator call sites accordingly.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-39910?
CVE-2025-39910 is considered a medium severity vulnerability in the Linux kernel.
How do I fix CVE-2025-39910?
To fix CVE-2025-39910, update your Linux kernel to the most recent version provided by your distribution.
What systems are affected by CVE-2025-39910?
CVE-2025-39910 affects all versions of the Linux kernel that do not incorporate the fix.
What is kasan_populate_vmalloc() in CVE-2025-39910?
kasan_populate_vmalloc() is a function in the Linux kernel that incorrectly ignores the caller's gfp_mask during memory allocation.
Are there any workarounds for CVE-2025-39910?
There are no known workarounds for CVE-2025-39910; updating the kernel is strongly recommended.