CVE-2025-38510

kasan: remove kasan_find_vm_area() to prevent possible deadlock

published August 16, 2025

CVSS
—
EPSS
0%
Percentile
4.4
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

kasan: remove kasan_find_vm_area() to prevent possible deadlock

find_vm_area() couldn't be called in atomic_context. If find_vm_area() is

called to reports vm area information, kasan can trigger deadlock like:

CPU0 CPU1

vmalloc();

alloc_vmap_area();

spin_lock(&vn->busy.lock)

spin_lock_bh(&some_lock);

<interrupt occurs>

<in softirq>

spin_lock(&some_lock);

<access invalid address>

kasan_report();

print_report();

print_address_description();

kasan_find_vm_area();

find_vm_area();

spin_lock(&vn->busy.lock) // deadlock!

To prevent possible deadlock while kasan reports, remove kasan_find_vm_area().

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00156 · 4.4th percentile
Published
2025-08-16T10:54Z
EPSS history
Timeline
  • 16 AUG 10:54Z
    kasan: remove kasan_find_vm_area() to prevent possible deadlock
    cvelistv5