CVE-2025-38008

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

mm/page_alloc: fix race condition in unaccepted memory handling

The page allocator tracks the number of zones that have unaccepted memory

using static_branch_enc/dec() and uses that static branch in hot paths to

determine if it needs to deal with unaccepted memory.

Borislav and Thomas pointed out that the tracking is racy: operations on

static_branch are not serialized against adding/removing unaccepted pages

to/from the zone.

Sanity checks inside static_branch machinery detects it:

WARNING: CPU: 0 PID: 10 at kernel/jump_label.c:276 __static_key_slow_dec_cpuslocked+0x8e/0xa0

The comment around the WARN() explains the problem:

/*

* Warn about the '-1' case though; since that means a

* decrement is concurrent with a first (0->1) increment. IOW

* people are trying to disable something that wasn't yet fully

* enabled. This suggests an ordering problem on the user side.

*/

The effect of this static_branch

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References