CVE-2025-39736 mm/kmemleak: avoid deadlock by moving pr_warn() outside kmemleak_lock
A deadlock in the Linux kernel memory leak detector can cause a denial of service when netpoll is enabled.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-39736?
CVE-2025-39736 is a medium-severity vulnerability in Debian Debian Linux, published on 11 Sep 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
mm/kmemleak: avoid deadlock by moving pr_warn() outside kmemleak_lock
When netpoll is enabled, calling pr_warn_once() while holding kmemleak_lock in mem_pool_alloc() can cause a deadlock due to lock inversion with the netconsole subsystem. This occurs because pr_warn_once() may trigger netpoll, which eventually leads to __alloc_skb() and back into kmemleak code, attempting to reacquire kmemleak_lock.
This is the path for the deadlock.
mem_pool_alloc() -> raw_spin_lock_irqsave(&kmemleak_lock, flags); -> pr_warn_once() -> netconsole subsystem -> netpoll -> __alloc_skb -> __create_object -> raw_spin_lock_irqsave(&kmemleak_lock, flags);
Fix this by setting a flag and issuing the pr_warn_once() after kmemleak_lock is released.
Weakness: CWE-667
Which versions are affected by CVE-2025-39736?
It affects 2 products.
Products include Debian Debian Linux, Linux kernel.
How do I fix CVE-2025-39736?
Apply the vendor's patch.
Is CVE-2025-39736 being exploited?
There is no known exploitation of CVE-2025-39736 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as AZL-67172, BELL-CVE-2025-39736, DEBIAN-CVE-2025-39736, GHSA-7g87-hx7m-ppg8, ROOT-OS-DEBIAN-11-CVE-2025-39736, ROOT-OS-DEBIAN-12-CVE-2025-39736 and 3 more.